CVE-2026-11501
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A security flaw in SourceCodester Hospitals Patient Records Management System 1.0 allows SQL injection in the file /classes/Master.php?f=save_patient via the ID argument. The attack can be launched remotely and the exploit has been publicly released.
Risk Assessment
The organization is at risk of SQL injection attacks that could lead to unauthorized database access, patient data leakage, and potential data modification or deletion.
Recommendation
Immediately upgrade the system to the latest version or apply patches to prevent SQL injection, and restrict access to the system.
Other vulnerabilities in SourceCodester Hospitals Patient Records Management System
See all- CVE-2026-9356High
A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. An unknown function in /admin/patients/manage_history.php allows manipulation of the ID argument leading to SQL injection. Remote attack is possible and the exploit has been disclosed.
- CVE-2026-9355High
A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. An unknown function in /classes/Master.php?f=save_patient_history allows manipulation of the ID argument leading to SQL injection. Remote attack is possible and the exploit has been published.
- CVE-2026-9342Medium
A SQL Injection vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /admin/patients/view_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=save_patient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.