CVE-2026-76574
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Risk Assessment
An attacker could gain unauthorized access to the system, take over user accounts, or steal sensitive medical data.
Recommendation
Apply vendor-provided patches or restrict access to the system, and use parameterized queries to prevent SQL injection.
Other vulnerabilities in Hospital Information System
See all- CVE-2026-86302Medium
A vulnerability was found in code-projects Hospital Information System 1.0, affecting the file /HIS/his.sql of the SQL Database Backup File Handler component. Manipulation results in information disclosure. Remote exploitation is possible, and the exploit has been made public.
- CVE-2026-86301Low
In the Hospital Information System 1.0 from code-projects, in the file /HIS/src/patients/editPatient.php within the Patient Management component, manipulation of the argument ID leads to cross-site scripting (XSS). The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-85399High
A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-85398High
A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- CVE-2026-85397High
A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Original NVD description (English source)
A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS