PatchSiren cyber security CVE debrief
CVE-2026-10209 code-projects CVE debrief
A SQL injection vulnerability exists in the Online Hospital Management System 1.0 from code-projects. The flaw resides in the appointmentdetail.php file within the Appointment Handler component, where the editid parameter is improperly sanitized. An attacker with low privileges can manipulate this argument to inject malicious SQL commands remotely. The vulnerability has been publicly disclosed and an exploit is available, though the CVSS 4.0 base score of 2.1 reflects limited impacts on confidentiality, integrity, and availability under the assessed metrics. The vendor is currently identified as unknown with low confidence based on reference domain analysis pointing to Code Projects.
- Vendor
- code-projects
- Product
- Online Hospital Management System
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Organizations running code-projects Online Hospital Management System 1.0, particularly healthcare institutions using this PHP-based application for appointment management. Security teams should prioritize this if the application is internet-facing and cannot be immediately patched.
Technical summary
The vulnerability is a SQL injection flaw in appointmentdetail.php affecting the editid argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) indicates network accessibility, low attack complexity, low privilege requirements, and proven exploit existence with limited impact scope. No CPE criteria are currently available in the source data.
Defensive priority
LOW
Recommended defensive actions
- Restrict network access to the Online Hospital Management System application to trusted users and monitor for anomalous database queries
- Apply input validation and parameterized queries to the editid parameter in appointmentdetail.php
- Review database logs for suspicious SQL patterns indicative of injection attempts against the Appointment Handler component
- Contact code-projects or the project maintainer for patch availability and apply updates when released
- Consider web application firewall rules to detect and block common SQL injection payloads targeting the editid parameter
Evidence notes
The vulnerability was reported through VulDB (submission 824988, vuln ID 367488) with references to a GitHub issue containing disclosure details. The CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction needed. Weaknesses are classified as CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection).
Official resources
Public disclosure occurred on 2026-06-01 with exploit details published. The vulnerability is not listed in CISA KEV.