Hospitals Patient Records Management System CVE-2026-10184

Q: What is the CVSS score of CVE-2026-10184?

CVE-2026-10184 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33506 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-31 cna@vuldb.com

GHSA-cvqv-2wqp-3x8w

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 31, 2026 - 14:30 vuln.today

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This impacts an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Hospitals Patient Records Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /classes/Users.php?f=delete, enabling unauthorized read and write access to the underlying database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier confirms publicly available exploit code exists. While CVSS impact scores are rated Low across confidentiality, integrity, and availability, the unauthenticated network accessibility combined with a live POC elevates the practical deployment risk for any internet-exposed instance.

Technical ContextAI

The affected application is a PHP-based hospital patient records management system distributed by SourceCodester, a provider of open-source academic and small-business web applications. The vulnerable endpoint /classes/Users.php?f=delete processes a user-supplied ID parameter without adequate sanitization or parameterized query usage before constructing SQL statements. The root cause is classified as CWE-74 (Injection), the broad injection weakness class encompassing SQL injection (CWE-89), indicating the application directly interpolates untrusted input into a database query. The PHP tag confirms the server-side language; no specific database engine is identified in available data, though SourceCodester projects of this type commonly use MySQL. No CPE string was provided, limiting precise version scoping beyond the stated version 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace direct string interpolation of the ID parameter in /classes/Users.php with parameterized prepared statements (e.g., PDO or MySQLi with bound parameters), which eliminates the injection surface at the root cause. As an immediate compensating control, operators should restrict access to the /classes/Users.php endpoint to authenticated administrative sessions only via application-layer or web server access controls (e.g., .htaccess IP allowlisting or session validation middleware), though this does not fix the underlying flaw and introduces management overhead. Input validation on the ID parameter (strict integer casting via intval() in PHP) provides an additional defensive layer but should not be treated as a sole fix. Any internet-exposed deployment of this system should be taken offline or placed behind a web application firewall with SQLi ruleset enabled (e.g., ModSecurity with OWASP CRS) until a proper fix is applied. Reference: github.com/zzb1388/cve2/issues/2 and vuldb.com/vuln/367465.