CVE-2026-9356
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. An unknown function in /admin/patients/manage_history.php allows manipulation of the ID argument leading to SQL injection. Remote attack is possible and the exploit has been disclosed.
Risk Assessment
Risk of unauthorized access to sensitive patient data and modification of medical records.
Recommendation
Update the system or apply SQL injection protections such as input validation and parameterized queries.
Other vulnerabilities in SourceCodester Hospitals Patient Records Management System
See all- CVE-2026-11501High
A security flaw in SourceCodester Hospitals Patient Records Management System 1.0 allows SQL injection in the file /classes/Master.php?f=save_patient via the ID argument. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2026-9355High
A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. An unknown function in /classes/Master.php?f=save_patient_history allows manipulation of the ID argument leading to SQL injection. Remote attack is possible and the exploit has been published.
- CVE-2026-9342Medium
A SQL Injection vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /admin/patients/view_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/manage_history.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.