CVE-2026-10184
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=delete via the ID argument. The attack can be executed remotely and the exploit is publicly available.
Risk Assessment
An attacker can delete or extract patient data, potentially leading to data loss and privacy breaches.
Recommendation
Immediately update the system or apply a fix that prevents SQL injection, such as using prepared statements.
Other vulnerabilities in Hospitals Patient Records Management System
See all- CVE-2026-11468Low
Vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The file /admin/?page=room_types is vulnerable to XSS via manipulation of the room argument. The attack can be performed remotely.
- CVE-2026-10185High
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=save via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-9564Low
A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This impacts an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.