CVE-2026-3171

An attacker can gain unauthorized access to sensitive patient information by exploiting a flaw in the queue management system's patient search feature, which can be done remotely. This vulnerability requires no special access or credentials, making it easier for malicious users to take advantage of it.

An attacker can remotely manipulate the patient ID in the queue management system to gain unauthorized access to sensitive functions, potentially allowing them to view or alter patient information. This vulnerability can be exploited without needing any special access or credentials.

An attacker can inject malicious scripts into the Patients Waiting Area Queue Management System by manipulating the First Name or Last Name fields in the patient search function, allowing them to execute harmful actions on users' browsers. This vulnerability can be exploited remotely, meaning attackers don't need physical access to the system to carry out their attack.