CVE-2026-1147

CWE-79 — Cross-site Scripting (XSS)CWE-94 — Code Injection3 documents3 sources
Severity
5.1MEDIUM
EPSS
0.0%
top 90.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Patrick Mvuma Patients Waiting Area Queue Management SystemSourcecodester Patients Waiting Area Queue Management SystemPamzey Patients Waiting Area Queue Management System
Timeline
PublishedJan 19

Description

A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_patient_schedule.php. Performing a manipulation of the argument Reason results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

🔴Vulnerability Details

2
GHSA
GHSA-2rq2-hm3x-v2v9: A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1↗2026-01-19
▶
CVEList
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scripting↗2026-01-19
▶
CVE-2026-1147 (MEDIUM CVSS 5.1) | A vulnerability was found in Source | cvebase.io