Is there a public PoC exploit available for CVE-2026-5960?

Yes, a public proof-of-concept exploit is available for CVE-2026-5960. Prioritise patching immediately. EPSS: 0.0%.

Patient Record Management System CVE-2026-5960

Q: What is the CVSS score of CVE-2026-5960?

CVE-2026-5960 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20930 LOW

Information Exposure (CWE-200)

2026-04-09 VulDB

GHSA-48cj-9hxc-pmg3

Information Disclosure Patient Record Management System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 16:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 15:30 euvd

EUVD-2026-20930

Analysis Generated

Apr 09, 2026 - 15:30 vuln.today

CVE Published

Apr 09, 2026 - 15:15 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Information disclosure in code-projects Patient Record Management System 1.0 allows unauthenticated remote attackers to access sensitive patient data via manipulation of the SQL database backup file (/db/hcpms.sql), with publicly available exploit code and user interaction required. The vulnerability affects the SQL Database Backup File Handler component and has moderate CVSS impact (4.3) but is elevated by public exploit availability and the sensitivity of healthcare data exposure.

Technical ContextAI

The vulnerability exists in the SQL Database Backup File Handler component that processes the /db/hcpms.sql file within code-projects Patient Record Management System 1.0. The underlying weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper access controls or insufficient protection mechanisms around database backup files. The attack involves manipulating or accessing an unprotected SQL backup file that likely contains plaintext credentials, patient records, or other sensitive healthcare information. The CPE cpe:2.3:a:code-projects:patient_record_management_system:*:*:*:*:*:*:*:* indicates all versions and configurations of this product are potentially affected. The remote attack vector combined with no privilege requirement suggests the backup file may be accessible through web-facing directories without authentication.

RemediationAI

Immediate action: Verify that /db/hcpms.sql and other database backup files are not accessible through web-facing directories (remove from web root or restrict with .htaccess/.web.config deny rules). Contact code-projects.org (https://code-projects.org/) to confirm patch availability and obtain a patched version; if no patch has been released, request security advisory status. As an interim control, implement authentication and access controls on all database-related files, restrict file permissions to prevent unauthorized reading, and move backup files outside the web-accessible directory structure. Audit server logs to detect past unauthorized access to /db/hcpms.sql. If the system is healthcare-regulated, initiate breach notification procedures and audit patient record access logs for evidence of compromise.