PatchSiren cyber security CVE debrief
CVE-2026-10186 code-projects CVE debrief
A SQL injection vulnerability exists in code-projects Online Hospital Management System 1.0, specifically within the /patient.php file. The editid parameter is susceptible to manipulation, allowing remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with available exploit information, increasing the risk of active exploitation. The CVSS 4.0 vector indicates network attack vector with low complexity, no required privileges, and no user interaction needed, with low impacts to confidentiality, integrity, and availability. The weakness classifications include CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (Improper Neutralization of Special Elements in an SQL Command).
- Vendor
- code-projects
- Product
- Online Hospital Management System
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-31
- Original CVE updated
- 2026-05-31
- Advisory published
- 2026-05-31
- Advisory updated
- 2026-05-31
Who should care
Healthcare organizations, medical IT administrators, and security teams managing hospital management systems or PHP-based healthcare applications. Organizations using code-projects Online Hospital Management System should prioritize patching.
Technical summary
The /patient.php file in code-projects Online Hospital Management System 1.0 fails to properly sanitize the editid parameter, enabling SQL injection attacks. Remote attackers can manipulate this parameter to execute arbitrary SQL commands against the backend database. The vulnerability requires no authentication or user interaction, making it accessible to any network-accessible attacker. The publicly disclosed exploit increases immediate exploitation risk.
Defensive priority
medium
Recommended defensive actions
- Apply input validation and parameterized queries to the editid parameter in /patient.php
- Implement prepared statements to prevent SQL injection in patient data handling
- Review and sanitize all user-supplied input in the Online Hospital Management System
- Monitor for suspicious database query patterns targeting patient records
- Restrict network access to the hospital management system where possible
- Apply principle of least privilege to database accounts used by the application
- Review source reference materials for additional technical details on the vulnerability
Evidence notes
Vulnerability disclosed via VulDB with public exploit reference. CNA-assigned weaknesses: CWE-74, CWE-89. CVSS 4.0 score: 5.5 (MEDIUM). Attack vector: network, no privileges required, no user interaction. Public exploit disclosure confirmed by source references.
Official resources
public