Is there a public PoC exploit available for CVE-2026-11501?

Yes, a public proof-of-concept exploit is available for CVE-2026-11501. Prioritise patching immediately. EPSS: 0.0%.

Hospitals Patient Records CVE-2026-11501

Q: What is the CVSS score of CVE-2026-11501?

CVE-2026-11501 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35035 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-mwjq-8mjr-x9qx

PHP SQLi Hospitals Patient Records Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:36 vuln.today

Severity Changed

Jun 08, 2026 - 10:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 10:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=save_patient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Hospitals Patient Records Management System 1.0 exposes sensitive patient data to remote, unauthenticated attackers via the ID parameter in the /classes/Master.php?f=save_patient endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, attack prerequisites, or user interaction are required, making this trivially exploitable from the network. A publicly available exploit exists (CVSS E:P), elevating real-world risk beyond what the moderate base score of 5.5 suggests; no public exploit identified at time of analysis rises to KEV level, but the POC lowers the barrier for opportunistic attackers targeting healthcare data.

Technical ContextAI

The affected application is a PHP-based web application (tagged PHP, SQLi) built by SourceCodester, identified via CPE cpe:2.3:a:sourcecodester:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*. The vulnerability class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input - specifically the ID argument passed to the save_patient function in /classes/Master.php - is concatenated directly into a SQL query without parameterization or sufficient sanitization. This is a classic unsanitized parameter injection pattern common in low-code PHP CRUD applications. Because the CPE uses a wildcard version match (*), all available versions of the system are presumed affected.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace direct string concatenation in SQL queries with parameterized queries or prepared statements in /classes/Master.php, specifically within the save_patient function - this eliminates the injection vector at the root cause. As a compensating control, deploying a Web Application Firewall (WAF) with SQL injection detection rules can block or alert on exploit attempts targeting the ID parameter, though WAF bypass is possible for motivated attackers. Input validation enforcing that the ID field accepts only expected data types (e.g., integer-only values) reduces the attack surface but is not a substitute for parameterized queries. Restricting network access to the application's web interface to trusted IP ranges or internal networks limits exposure to remote attackers, at the cost of reduced accessibility. Organizations should monitor VulDB (https://vuldb.com/cve/CVE-2026-11501) and the SourceCodester site for vendor patch releases.