CVE-2026-10185
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=save via the ID argument. The attack can be executed remotely and the exploit is publicly available.
Risk Assessment
An attacker can modify or extract patient data, potentially compromising the confidentiality and integrity of medical records.
Recommendation
Immediately update the system or apply a fix that prevents SQL injection, such as using parameterized queries.
Other vulnerabilities in Hospitals Patient Records Management System
See all- CVE-2026-11468Low
Vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The file /admin/?page=room_types is vulnerable to XSS via manipulation of the room argument. The attack can be performed remotely.
- CVE-2026-10184High
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=delete via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-9564Low
A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in SourceCodester Hospitals Patient Records Management System 1.0. Affected is an unknown function of the file /classes/Users.php?f=save. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.