CVE-2026-36388 describes a stored Cross-Site Scripting (XSS) vulnerability in PHPGurukal Hospital Management System version 4.0. The vulnerability arises from insufficient input sanitization of the User Name parameter on the edit-profile.php page, which allows an authenticated patient to inject malicious JavaScript code. This code is stored persistently and executed when viewed by a doctor, potentially compromising the doctor's session or data. No CVSS score or vendor remediation details are provided.

Successful exploitation allows an authenticated patient to execute arbitrary scripts in the context of a doctor's session within the hospital management system. This could lead to session hijacking, unauthorized actions, or disclosure of sensitive information accessible to the doctor interface. However, the vulnerability requires authentication as a patient and no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict patient input in the User Name field to disallow script characters or implement server-side input validation and output encoding to prevent script injection. Monitor vendor channels for official patches or updates.