CVE-2026-2154

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /registration.php of the component Patient Registration Module. The manipulation of the argument First Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-215487.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges neeCVE-2026-215497.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-21557.2A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz oCVE-2026-215507.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215517.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215527.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215537.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215547.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215557.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-21564.8A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the filCVE-2026-215697.9This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. ThCVE-2026-21577.2A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_ro
CVE-2026-2154: Medium severity, CVSS 6.1 | Vulnix