CVE-2026-10209

MediumCVSS 6.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file appointmentdetail.php of the Appointment Handler component via the editid argument. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

An attacker can execute arbitrary SQL queries against the database, potentially leading to patient data theft, modification, or full system compromise.

Recommendation

Apply a security fix immediately, such as input validation and using parameterized SQL queries.

Other vulnerabilities in code-projects Online Hospital Management System

CVE-2026-10208High
A SQL injection vulnerability was found in code-projects Online Hospital Management System 1.php in the file login_1.php in the login_user function. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

Original NVD description (English source)

A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.