CVE-2026-3724

An attacker can gain unauthorized access to sensitive patient information by exploiting a flaw in the queue management system's patient search feature, which can be done remotely. This vulnerability requires no special access or credentials, making it easier for malicious users to take advantage of it.

This vulnerability allows an attacker to inject malicious scripts into the queue management system, which could then be executed in the browsers of users visiting the site. The attacker can exploit this remotely by manipulating the names entered in the system, making it a risk for anyone using the application.

An attacker can inject malicious scripts into the Patients Waiting Area Queue Management System by manipulating the First Name or Last Name fields in the patient search function, allowing them to execute harmful actions on users' browsers. This vulnerability can be exploited remotely, meaning attackers don't need physical access to the system to carry out their attack.