CVE-2026-7631
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was found in code-projects Online Hospital Management System 1.0 in the Registration Handler component where manipulation of the Username argument leads to improper authorization. The attack can be executed remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can bypass authorization mechanisms and gain unauthorized access to system functions. This may lead to breaches of confidentiality and integrity of medical data.
Recommendation
Upgrade the system to a patched version or implement your own authorization safeguards. Until fixed, restrict access to registration functionality.
Other vulnerabilities in Online Hospital Management System
See all- CVE-2026-10299Low
A weakness has been identified in code-projects Online Hospital Management System 1.0 in the file viewdoctortimings.php. Manipulation of the delid argument causes improper control of resource identifiers. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-10186High
An SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file /patient.php via the editid argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-7632High
A vulnerability was identified in the Online Hospital Management System version 1.0, affecting an unknown function in the /viewappointment.php file. Manipulation of the delid argument leads to SQL injection.
Original NVD description (English source)
A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the component Registration Handler. The manipulation of the argument Username results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS