CVE-2026-9342
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A SQL Injection vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /admin/patients/view_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Risk Assessment
Risk of sensitive patient data leakage and potential modification or deletion of medical records.
Recommendation
Immediately validate and sanitize input in view_history.php and use parameterized queries.
Other vulnerabilities in SourceCodester Hospitals Patient Records Management System
See all- CVE-2026-11501High
A security flaw in SourceCodester Hospitals Patient Records Management System 1.0 allows SQL injection in the file /classes/Master.php?f=save_patient via the ID argument. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2026-9356High
A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. An unknown function in /admin/patients/manage_history.php allows manipulation of the ID argument leading to SQL injection. Remote attack is possible and the exploit has been disclosed.
- CVE-2026-9355High
A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. An unknown function in /classes/Master.php?f=save_patient_history allows manipulation of the ID argument leading to SQL injection. Remote attack is possible and the exploit has been published.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. Impacted is an unknown function of the file /admin/patients/view_history.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.