CVE-2026-10186
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file /patient.php via the editid argument. The attack can be executed remotely and the exploit is publicly available.
Risk Assessment
An attacker can gain unauthorized access to patient data and other sensitive information in the hospital database.
Recommendation
Immediately update the system or apply a fix that prevents SQL injection, such as using prepared statements.
Other vulnerabilities in Online Hospital Management System
See all- CVE-2026-7632High
A vulnerability was identified in the Online Hospital Management System version 1.0, affecting an unknown function in the /viewappointment.php file. Manipulation of the delid argument leads to SQL injection.
- CVE-2026-10299Low
A weakness has been identified in code-projects Online Hospital Management System 1.0 in the file viewdoctortimings.php. Manipulation of the delid argument causes improper control of resource identifiers. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Online Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /patient.php. Such manipulation of the argument editid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.