Which versions of Online Hospital Management System are affected by CVE-2026-10208?

code-projects Online Hospital Management System contains a critical SQL injection vulnerability (CVE-2026-10208) in its login authentication function that allows unauthenticated attackers to execute…

Is there a public PoC exploit available for CVE-2026-10208?

Yes, a public proof-of-concept exploit is available for CVE-2026-10208. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10208?

Within 24 hours: Identify all instances of code-projects Online Hospital Management System across your infrastructure and assess direct database access scope; begin continuous monitoring for suspicious SQL patterns in login activity. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection payloads on the login parameter; implement strict input validation rejecting SQL metacharacters in the Username field; configure database accounts to least-privilege access scope. Within 30 days: Contact vendor for patch timeline and workarounds; evaluate alternative hospital management systems; develop migration or isolation plan based on vendor response.

Online Hospital Management System CVE-2026-10208

Q: What is the CVSS score of CVE-2026-10208?

CVE-2026-10208 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33529 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-6362-h33q-vf9h

PHP SQLi Online Hospital Management System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 02:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 01:57 vuln.today

DescriptionCVE.org

A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Online Hospital Management System 1.php enables remote unauthenticated attackers to manipulate the Username parameter sent to the login_user function in login_1.php, allowing arbitrary SQL query execution against the backend database. Publicly available exploit code exists (published on GitHub by researcher Mi0uno), increasing the likelihood of opportunistic exploitation, though the CVE is not listed in CISA KEV and EPSS data is not provided. Per CVSS, exploitation requires no authentication or user interaction and impacts confidentiality, integrity, and availability at a low level (CVSS 7.3).

Technical ContextAI

The vulnerability resides in a PHP-based hospital management application authored by code-projects, distributed via code-projects.org. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the login_user function in login_1.php concatenates or otherwise unsafely incorporates the Username request parameter directly into a SQL statement rather than using parameterized queries or prepared statements. The affected CPE is cpe:2.3:a:code-projects:online_hospital_management_system, which is a freely distributed PHP/MySQL learning/demo project commonly deployed on LAMP stacks. Because the flaw is in the login flow itself, it is reachable pre-authentication on any exposed instance.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects has not published an advisory or fixed release in the supplied references. As compensating controls, replace the vulnerable SQL in login_1.php's login_user function with prepared statements using PDO or mysqli parameter binding (this is the only durable fix and has no functional side effects). If source-level changes are not feasible immediately, restrict access to the application using network ACLs, VPN, or IP allowlisting so the login page is unreachable from the public internet; this breaks remote workflows for legitimate users and so is only a stopgap. Deploying a WAF with SQLi signatures in front of login_1.php (e.g., ModSecurity with OWASP CRS) can blunt the published PoC but is bypassable by skilled attackers. Monitor https://vuldb.com/vuln/367487 and https://code-projects.org/ for an upstream fix, and review database query logs for anomalous Username payloads (quotes, UNION, comment sequences).