PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10209 code-projects CVE debrief

A SQL injection vulnerability exists in the Online Hospital Management System 1.0 from code-projects. The flaw resides in the appointmentdetail.php file within the Appointment Handler component, where the editid parameter is improperly sanitized. An attacker with low privileges can manipulate this argument to inject malicious SQL commands remotely. The vulnerability has been publicly disclosed and an exploit is available, though the CVSS 4.0 base score of 2.1 reflects limited impacts on confidentiality, integrity, and availability under the assessed metrics. The vendor is currently identified as unknown with low confidence based on reference domain analysis pointing to Code Projects.

Vendor
code-projects
Product
Online Hospital Management System
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running code-projects Online Hospital Management System 1.0, particularly healthcare institutions using this PHP-based application for appointment management. Security teams should prioritize this if the application is internet-facing and cannot be immediately patched.

Technical summary

The vulnerability is a SQL injection flaw in appointmentdetail.php affecting the editid argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) indicates network accessibility, low attack complexity, low privilege requirements, and proven exploit existence with limited impact scope. No CPE criteria are currently available in the source data.

Defensive priority

LOW

Recommended defensive actions

  • Restrict network access to the Online Hospital Management System application to trusted users and monitor for anomalous database queries
  • Apply input validation and parameterized queries to the editid parameter in appointmentdetail.php
  • Review database logs for suspicious SQL patterns indicative of injection attempts against the Appointment Handler component
  • Contact code-projects or the project maintainer for patch availability and apply updates when released
  • Consider web application firewall rules to detect and block common SQL injection payloads targeting the editid parameter

Evidence notes

The vulnerability was reported through VulDB (submission 824988, vuln ID 367488) with references to a GitHub issue containing disclosure details. The CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction needed. Weaknesses are classified as CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10209 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10209

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10209 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10209

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.