CVE-2026-36324 identifies a Cross Site Scripting (XSS) vulnerability in SourceCodester Doctor Appointment System 1.0. The issue arises from insufficient input validation in the user registration page (register.php), allowing attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability. No patch or official remediation guidance is currently documented.

Successful exploitation of this XSS vulnerability could allow attackers to execute arbitrary scripts in the context of other users, potentially leading to theft of session tokens, defacement, or other unauthorized actions affecting confidentiality and integrity of user data. Availability is not impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and output encoding on the user registration inputs as a temporary mitigation. Monitor vendor channels for updates and patches addressing this vulnerability.