CVE-2026-2150: Pre-Auth XSS in Patients Waiting Area Queue Management System 1.0

Critical Vulnerability Information CVE ID: CVE-2026-2150 VulDB ID: VDB-344852, GCVE-100-344852 CVSS Meta Temp Score: 3.9 Current Exploit Price: $0-$5k CTI Interest Score: 3.42 Vulnerability Overview Affected System: SourceCodeSter/Patrick Mvuma Patients Waiting Area Queue Management System 1.0 Vulnerability Type: Cross-Site Scripting (XSS) Affected File: /checkin.php Affected Parameter: patient_id CVE Classification: CWE-79 Description This vulnerability was discovered in SourceCodeSter/Patrick Mvuma Patients Waiting Area Queue Management System 1.0 and is classified as a problematic issue. Manipulation of the parameter leads to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is uniquely identified by CVE-2026-2150, can be exploited remotely, and has known exploitation potential. Details CVSS Rating: Considered problematic. Affected Unknown Code Section: An unknown section of the /checkin.php file is affected by this issue. CWE Classification: CWE-79 — the product does not properly neutralize or only partially neutralizes user-controllable input before placing it in output that is provided to other users as a web page. Impact: Integrity is compromised. Announcement: The vulnerability advisory is available for download on github.com. Vulnerability Handling: Treated as CVE-2026-2150. Exploit Difficulty: Known to be easy. Attack Vector: Can be initiated remotely. Exploit Requirements: No authentication required. Successful Exploitation Requirements: Requires user interaction from the victim. Technical Details and Public Exploits: Known. MITRE ATT&CK Tactic: T1059.007.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-2150: Pre-Auth XSS in Patients Waiting Area Queue Management System 1.0