CVE-2026-36388 describes a stored Cross-Site Scripting (XSS) vulnerability in PHPGurukal Hospital Management System v4.0. The issue occurs in the edit-profile.php page where an authenticated patient user can inject malicious JavaScript into the User Name parameter. This script is stored persistently and rendered in the doctor's interface, potentially allowing script execution in the context of the doctor’s session. The vulnerability requires authentication and user interaction (UI:R), has low attack complexity (AC:L), and impacts confidentiality and integrity with no impact on availability.

An authenticated patient can inject and store malicious scripts that execute in the context of the doctor’s interface. This can lead to unauthorized disclosure of sensitive information or manipulation of data viewed by the doctor. The vulnerability affects confidentiality and integrity but does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and output encoding on the User Name parameter to prevent script injection. Restricting the characters allowed in user input and sanitizing stored data before rendering can reduce risk.