SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System Patient Registration registration.php cross site scripting

The XSS vulnerability in SourceCodester Patients Waiting Area Queue Management System allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a user's browser when they visit a vulnerable page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application. The public availability of a proof-of-concept significantly lowers the barrier to entry for attackers, increasing the likelihood of exploitation. The impact is amplified if the application is used to handle sensitive patient data, as attackers could potentially gain access to this information.

Healthcare providers and organizations utilizing SourceCodester Patients Waiting Area Queue Management System version 1.0, particularly those with publicly accessible web interfaces, are at significant risk. Shared hosting environments where multiple users share the same server are also vulnerable, as an attacker could potentially compromise other users' accounts through this XSS vulnerability.

• php / web:

grep -r "/registration.php" /var/www/html/

• php / web:

curl -I http://your-server.com/registration.php?First_Name=<script>alert(1)</script>

• generic web:

curl -I http://your-server.com/registration.php?First_Name=<script>alert(1)</script> | grep -i 'script'

1. 2026-02-08Disclosure

   disclosure

1. Reservado2026-02-07
2. Publicada2026-02-08
3. Modificada2026-02-23
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-2154 is to upgrade to a patched version of SourceCodester Patients Waiting Area Queue Management System as soon as it becomes available. Until a patch is released, implement temporary mitigations such as input validation and output encoding on the First Name field in /registration.php. Web application firewalls (WAFs) can be configured to detect and block malicious XSS payloads targeting this vulnerability. Regularly scan the application for XSS vulnerabilities using automated tools.