CVE-2026-10208

HighCVSS 7.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A SQL injection vulnerability was found in code-projects Online Hospital Management System 1.php in the file login_1.php in the login_user function. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

Risk Assessment

An attacker can bypass the login mechanism and gain unauthorized access to the hospital management system, potentially leading to leakage of sensitive medical data.

Recommendation

Immediately update the system to the latest version or apply a patch that prevents SQL injection, such as using prepared statements.

Other vulnerabilities in code-projects Online Hospital Management System

CVE-2026-10209Medium
A SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file appointmentdetail.php of the Appointment Handler component via the editid argument. The attack can be performed remotely, and the exploit is publicly available.

Original NVD description (English source)

A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.