# CVE-2026-86301: code-projects Hospital Information System reflected XSS in patient ID parameter

Source: https://junglewise.ai/threats/cve-2026-86301-code-projects-hospital-information-system-reflected-xss-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86301 · Severity: low · CVSS 3.5 · Published 2026-09-07

A Hospital Information System used to manage patient records contains a reflected cross-site scripting (XSS) vulnerability in the patient edit functionality. An attacker can craft a malicious link that, when clicked by a hospital staff member, executes arbitrary JavaScript in their browser session, potentially allowing theft of session credentials, patient data manipulation, or unauthorized actions on behalf of the authenticated user.

Technologies: [Code-Projects Hospital Information System](https://junglewise.ai/threats/technologies/hospital-information-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-86301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86301 being exploited in the wild.

**How severe is CVE-2026-86301?** Low severity, with a CVSS score of 3.5, published 7 September 2026.

**Which products and versions are affected?** Code-Projects Hospital Information System 1.0.

**Is there a fix for CVE-2026-86301?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86301 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86301?** Check whether you run Code-Projects Hospital Information System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected XSS flaw in the /HIS/src/patients/editPatient.php file, specifically in the handling of the ID parameter. The vulnerable component fails to properly validate and encode user-supplied input before reflecting it in the HTTP response. An unauthenticated attacker can send a specially crafted URL with malicious JavaScript payload in the ID parameter to a hospital staff member. When the victim opens the link in their authenticated session, the JavaScript executes in their browser context. No authentication is required from the attacker; only the victim must be logged in and click the malicious link.

## Affected products

- code-projects Hospital Information System 1.0

## Timeline

- 2026-09-07: disclosed: Vulnerability published

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Hospital%20Information%20System%20%60id%60%20Parameter.md](https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Hospital%20Information%20System%20%60id%60%20Parameter.md)

## Related threats

- [code-projects Hospital Information System information disclosure via SQL backup](https://junglewise.ai/threats/cve-2026-86302-code-projects-hospital-information-system-information-disclosure)
- [code-projects Hospital Information System SQL injection](https://junglewise.ai/threats/cve-2026-85399-code-projects-hospital-information-system-sql-injection)
- [code-projects Hospital Information System SQL injection in ReqController](https://junglewise.ai/threats/cve-2026-85398-code-projects-hospital-information-system-sql-injection-in)
- [code-projects Hospital Information System SQL injection](https://junglewise.ai/threats/cve-2026-85397-code-projects-hospital-information-system-sql-injection)