# CVE-2026-9564: SourceCodester Hospital's Patient Records Management System XSS in view_patient

Source: https://junglewise.ai/threats/cve-2026-9564-sourcecodester-hospital-s-patient-records-management-system-xss-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9564 · Severity: low · CVSS 2.4 · Published 2026-05-26

A vulnerability exists in the Hospital's Patient Records Management System, a software used to manage medical patient data. An attacker can inject malicious scripts into the 'Remarks' field of a patient record, which could lead to the theft of administrative session tokens or unauthorized actions being performed in the context of an administrator's browser. This could compromise the privacy of patient records and the integrity of the management system.

Technologies: [SourceCodester Hospital's Patient Records Management System](https://junglewise.ai/threats/technologies/hospital-s-patient-records-management-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-9564 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9564 being exploited in the wild.

**How severe is CVE-2026-9564?** Low severity, with a CVSS score of 2.4, published 26 May 2026.

**Which products and versions are affected?** SourceCodester Hospital's Patient Records Management System 1.0.

**Is there a fix for CVE-2026-9564?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9564 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9564?** Check whether you run SourceCodester Hospital's Patient Records Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Hospital's Patient Records Management System 1.0 within the '/admin/?page=patients/view_patient' endpoint. The root cause is the failure of the application to properly sanitize or encode the 'remarks' parameter before rendering it in the web interface. An attacker with sufficient privileges to modify patient records can inject malicious JavaScript. When an administrative user views the affected patient record, the script executes in their browser, potentially allowing for session hijacking via cookie theft or unauthorized administrative actions. While the advisory mentions 'no login required' in one section, the CVSS metrics and file path suggest an administrative context (PR:H).

## Affected products

- SourceCodester Hospital's Patient Records Management System 1.0

## Timeline

- 2026-04-29: disclosed: Initial disclosure on GitHub issues
- 2026-05-26: advisory: NVD publication date

## References

- [https://github.com/Alanener/sysy/issues/1](https://github.com/Alanener/sysy/issues/1)
- [https://vuldb.com/submit/815674](https://vuldb.com/submit/815674)
- [https://vuldb.com/vuln/365626](https://vuldb.com/vuln/365626)
- [https://vuldb.com/vuln/365626/cti](https://vuldb.com/vuln/365626/cti)

## Related threats

- [SourceCodester Hospital's Patient Records Management System SQL injection in Master.php](https://junglewise.ai/threats/cve-2026-11501-sourcecodester-hospital-s-patient-records-management-system-sql)
- [SourceCodester Hospital's Patient Records Management System SQL injection](https://junglewise.ai/threats/cve-2026-9356-sourcecodester-hospital-s-patient-records-management-system-sql)