Is there a public PoC exploit available for CVE-2026-10209?

Yes, a public proof-of-concept exploit is available for CVE-2026-10209. Prioritise patching immediately. EPSS: 0.0%.

Online Hospital Management System CVE-2026-10209

Q: What is the CVSS score of CVE-2026-10209?

CVE-2026-10209 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33530 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-jww7-v7mx-3w46

PHP SQLi Online Hospital Management System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 01:57 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Online Hospital Management System 1.0 exposes backend database contents via the editid parameter in appointmentdetail.php. A low-privilege authenticated attacker can remotely manipulate SQL queries to read, modify, or corrupt patient and appointment records. A proof-of-concept exploit is publicly available per the GitHub reference, raising the likelihood of opportunistic exploitation against internet-facing deployments of this PHP application.

Technical ContextAI

The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) SQL injection rooted in unsanitized user input passed directly into a database query. The affected component is appointmentdetail.php, part of the Appointment Handler module in this PHP-based hospital management application. The editid GET/POST parameter is incorporated into a SQL statement without parameterization or escaping, allowing an attacker to alter query logic. The CPE string cpe:2.3:a:code-projects:online_hospital_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected version range beyond what the description states (version 1.0). The application is distributed by code-projects.org as a ready-made PHP project, suggesting it is unlikely to receive timely security patches.

RemediationAI

No vendor-released patch has been identified at time of analysis. The application originates from code-projects.org, which does not appear to maintain a formal security advisory process. The primary recommended fix is to rewrite the editid parameter handling in appointmentdetail.php to use prepared statements with parameterized queries (PDO or MySQLi), which eliminates the injection surface entirely. As a compensating control, deploying a Web Application Firewall (WAF) with SQL injection rules (e.g., ModSecurity with OWASP CRS) can block common SQLi payloads at the perimeter, though this introduces maintenance overhead and does not fix the root cause. Additionally, restricting database user privileges so the application account cannot access or modify tables outside its functional scope will limit the blast radius of any successful injection. Organizations should evaluate whether this software is internet-facing and, if so, consider restricting access to authenticated internal networks only until a code-level fix is applied. References: VulDB entry at https://vuldb.com/vuln/367488 and POC at https://github.com/Wanghuidi/CVE/issues/1.