CVE-2026-105386
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
An attacker can exploit SQL injection to gain unauthorized access to hospital data, potentially leading to patient privacy breaches or data manipulation.
Recommendation
Immediately apply patches or temporarily disable the affected functionality if possible, and monitor the system for suspicious activity.
Other vulnerabilities in HospitalManagementSystem
See all- CVE-2026-104638Medium
onetwothreeneth HospitalManagementSystem (up to 9ef91ed6007314b6473110ed699dff76d158f61d) has a vulnerability in php/sessions.php where manipulation of the ID argument leads to improper authentication. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-105385High
A SQL injection vulnerability was found in onetwothreeneth HospitalManagementSystem in the file transaction_details.php. Manipulating the transaction_id argument allows SQL injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-105384High
A SQL injection vulnerability was found in UNION HospitalManagementSystem in the file patient_info.php. Manipulating the patient_id argument allows SQL injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-105383High
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-105382High
A flaw was found in onetwothreeneth HospitalManagementSystem in the update_subaccount function of php/controller.php (Account Administration component). Manipulating the user_id argument causes improper authorization, and the vulnerability can be exploited remotely. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS