Hospital Management System CVE-2026-111990

Exploitation requires reaching the Appointment Cancellation Handler in admin-panel.php and supplying attacker-controlled input in the ID parameter, which flows unsanitized into a mysqli_query() call. The key limiting factor is access to the admin panel: the file name admin-panel.php indicates an administrative area that typically demands an authenticated administrator session, which directly conflicts with the input vector's PR:N claim - defenders should confirm whether this handler is exposed without authentication. There is no patched release (vendor unresponsive), so the condition for safety is running a fixed/forked version or placing the admin panel behind access controls; affected scope is any deployment at or before commit 777fda46b77a820977a5ba616283dbfbc40bf7e1.

This is a SQL injection flaw (CWE-89) in the kishan0725 Hospital Management System, a small open-source PHP project hosted on GitHub. The input CVSS 4.0 score is 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and uniformly LOW impact (VC:L/VI:L/VA:L), and the E:P threat metric indicates a proof-of-concept exploit. A public exploit exists (POC=YES) but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - the signal set points to publicly available exploit code without confirmed real-world attacks. CONFLICT TO VERIFY: the CVSS vector asserts PR:N (no privileges), yet the affected code lives in admin-panel.php (an administrative Appointment Cancellation Handler), which normally implies authenticated/administrative access - verify whether the endpoint is reachable pre-authentication, because this materially changes risk. Overall this is a genuine but low-to-moderate priority issue: the product is a hobby/educational project with negligible production footprint, the vendor has not responded to the issue report, and the rated impact is only partial. It is not a high-urgency item despite the public POC.

An attacker reaches the admin-panel.php Appointment Cancellation Handler and supplies a crafted value in the ID parameter that is concatenated into a mysqli_query call, injecting SQL to read or alter patient/appointment records in the backend database. A public proof-of-concept is already available via the project's GitHub issue tracker, and the network vector with low attack complexity (per the CVSS 4.0 vector) means the request can be delivered remotely; however, if the admin panel in fact requires a valid login, exploitation presupposes that access.