SecuriTricks - CVE-2026-4617

Description

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the file /php/api_patient_checkin.php of the component Patient Check-In Module. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

Product(s) Impacted

Vendor	Product	Versions
Sourcecodester	Patients Waiting Area Queue Management System	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-266

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	sourcecodester	patients_waiting_area_queue_management_system	/	/	/	/	/	/	/	/

References

https://gist.github.com/HxH404/0ab53ccba44456b5400a5908414f5ab1

https://vuldb.com/?ctiid.352481

https://vuldb.com/?id.352481

https://vuldb.com/?submit.775747

https://www.sourcecodester.com/

CVSS Score

6.9 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: LOW
Attack Requirements: NONE
Privileges Required: NONE
User Interaction: NONE
Scope:
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: LOW
Exploit Maturity: PROOF_OF_CONCEPT

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: March 24, 2026, 1:17 a.m.
Last Modified: March 24, 2026, 3:53 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-4617