Is there a public PoC exploit available for CVE-2026-10299?

Yes, a public proof-of-concept exploit is available for CVE-2026-10299. Prioritise patching immediately. EPSS: 0.1%.

Online Hospital Management System CVE-2026-10299

Q: What is the CVSS score of CVE-2026-10299?

CVE-2026-10299 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33832 LOW

Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)

2026-06-01 VulDB

GHSA-fc67-4f8m-6pmc

Information Disclosure PHP Online Hospital Management System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 23:30 vuln.today

CVSS changed

Jun 01, 2026 - 23:22 NVD

3.8 (LOW) 2.0 (LOW)

DescriptionCVE.org

A weakness has been identified in code-projects Online Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. This manipulation of the argument delid causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Insecure Direct Object Reference (IDOR) in code-projects Online Hospital Management System 1.0 allows a high-privileged remote attacker to manipulate the delid parameter in viewdoctortimings.php, resulting in unauthorized modification or deletion of doctor timing records beyond the attacker's intended access scope. The CVSS 4.0 score of 2.0 reflects the high privilege prerequisite (PR:H), low integrity impact (VI:L), and low availability impact (VA:L) to the vulnerable component. No public exploit identified at time of analysis as active exploitation - however, publicly available exploit code exists, documented in a GitHub proof-of-concept writeup.

Technical ContextAI

The vulnerability resides in viewdoctortimings.php, a PHP script within the Online Hospital Management System 1.0, developed by code-projects.org. The root cause is classified as CWE-99 (Improper Control of Resource Identifiers), the formal class for IDOR flaws where the application uses a user-controlled identifier - here the GET/POST parameter delid - to directly reference a backend resource (a doctor timing record) without enforcing sufficient authorization checks to confirm the requesting user owns or has rights to that specific record. The affected CPE is cpe:2.3:a:code-projects:online_hospital_management_system:*:*:*:*:*:*:*:*, indicating version 1.0 is the only known release and the wildcard version match suggests no patched release exists. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms network delivery, low complexity, no special attack requirements beyond credential access, and no user interaction needed once authenticated.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CPE wildcard and absence of any patch reference in the available intelligence confirm this. The primary remediation is to add server-side authorization checks in viewdoctortimings.php to validate that the authenticated session user owns or has explicit permission to act on the record identified by the delid parameter before processing the deletion or modification request. As a compensating control, restrict access to viewdoctortimings.php to only the minimum required admin roles via application-level or web server access controls (e.g., .htaccess IP allowlisting or role middleware), accepting the trade-off of reduced administrative flexibility. Additionally, implement audit logging on all delid parameter invocations to detect unauthorized access attempts. Organizations should monitor the VulDB entry at https://vuldb.com/vuln/367592 and the vendor site at https://code-projects.org/ for patch releases. Given the niche nature of this software, organizations should evaluate whether this system can be replaced with a more actively maintained alternative.