CVE-2021-38152: index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.

Security readout for executives and security teams

CVE-2021-38152 describes a cross-site scripting issue in Chikitsa Patient Management System 2.0.0, in the appointment patient-addition path. If reachable, it could let malicious script run in a user's browser within the application context. The public bundle does not provide CVSS scoring, vendor patch details, or evidence of active exploitation. Exposure is likely limited to organizations running Chikitsa Patient Management System 2.0.0, especially if appointment workflows are reachable by untrusted users or staff accounts processing untrusted patient data. Prioritize based on whether Chikitsa 2.0.0 is deployed and internet-facing. The issue is not documented as actively exploited, but healthcare workflow context raises concern because browser-session compromise can affect sensitive patient operations. Mitigation focus: Inventory Chikitsa deployments and confirm whether version 2.0.0 is present.; Check Chikitsa vendor guidance for fixed versions or recommended remediation.; Restrict access to appointment workflows until remediation is confirmed..

Prepared

Jun 2, 2026, 19:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.