PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10186 code-projects CVE debrief

A SQL injection vulnerability exists in code-projects Online Hospital Management System 1.0, specifically within the /patient.php file. The editid parameter is susceptible to manipulation, allowing remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with available exploit information, increasing the risk of active exploitation. The CVSS 4.0 vector indicates network attack vector with low complexity, no required privileges, and no user interaction needed, with low impacts to confidentiality, integrity, and availability. The weakness classifications include CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (Improper Neutralization of Special Elements in an SQL Command).

Vendor
code-projects
Product
Online Hospital Management System
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Healthcare organizations, medical IT administrators, and security teams managing hospital management systems or PHP-based healthcare applications. Organizations using code-projects Online Hospital Management System should prioritize patching.

Technical summary

The /patient.php file in code-projects Online Hospital Management System 1.0 fails to properly sanitize the editid parameter, enabling SQL injection attacks. Remote attackers can manipulate this parameter to execute arbitrary SQL commands against the backend database. The vulnerability requires no authentication or user interaction, making it accessible to any network-accessible attacker. The publicly disclosed exploit increases immediate exploitation risk.

Defensive priority

medium

Recommended defensive actions

  • Apply input validation and parameterized queries to the editid parameter in /patient.php
  • Implement prepared statements to prevent SQL injection in patient data handling
  • Review and sanitize all user-supplied input in the Online Hospital Management System
  • Monitor for suspicious database query patterns targeting patient records
  • Restrict network access to the hospital management system where possible
  • Apply principle of least privilege to database accounts used by the application
  • Review source reference materials for additional technical details on the vulnerability

Evidence notes

Vulnerability disclosed via VulDB with public exploit reference. CNA-assigned weaknesses: CWE-74, CWE-89. CVSS 4.0 score: 5.5 (MEDIUM). Attack vector: network, no privileges required, no user interaction. Public exploit disclosure confirmed by source references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10186 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10186

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10186 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10186

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.