CVE-2026-3817

An attacker can remotely manipulate the patient ID in the queue management system to gain unauthorized access to sensitive functions, potentially allowing them to view or alter patient information. This vulnerability can be exploited without needing any special access or credentials.

This vulnerability allows an attacker to inject malicious scripts into the queue management system, which could then be executed in the browsers of users visiting the site. The attacker can exploit this remotely by manipulating the names entered in the system, making it a risk for anyone using the application.

An attacker can inject malicious scripts into the Patients Waiting Area Queue Management System by manipulating the First Name or Last Name fields in the patient search function, allowing them to execute harmful actions on users' browsers. This vulnerability can be exploited remotely, meaning attackers don't need physical access to the system to carry out their attack.