Is there a public PoC exploit available for CVE-2026-6005?

Yes, a public proof-of-concept exploit is available for CVE-2026-6005. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6005

Q: What is the CVSS score of CVE-2026-6005?

CVE-2026-6005 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21295 LOW

SQL Injection (CWE-89)

2026-04-10 VulDB

GHSA-9qjr-82wx-8hcx

PHP SQLi Patient Record Management System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 04:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 03:45 euvd

EUVD-2026-21295

Analysis Generated

Apr 10, 2026 - 03:45 vuln.today

CVE Published

Apr 10, 2026 - 02:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function of the file /hematology_print.php. Executing a manipulation of the argument hem_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Patient Record Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the hem_id parameter in /hematology_print.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 6.3 (medium) with publicly available exploit code, though no CISA KEV confirmation indicates active widespread exploitation at time of analysis.

Technical ContextAI

The vulnerability exists in the PHP-based Patient Record Management System as a classic SQL injection flaw (CWE-89) in the /hematology_print.php file. The hem_id parameter fails to properly sanitize or parameterize user input before incorporating it into SQL queries, allowing attackers to inject malicious SQL syntax. The affected product is identified via CPE as code-projects Patient Record Management System (cpe:2.3:a:code-projects:patient_record_management_system:*:*:*:*:*:*:*:*), indicating all versions appear vulnerable. The attack vector is network-based over HTTP/HTTPS, targeting a web application endpoint handling hematology report printing functionality.

RemediationAI

Primary remediation requires upgrading to a patched version released by code-projects; however, no specific fixed version number is available in the current advisory data. Immediately contact code-projects.org or consult their security advisory for guidance on patched versions. As an interim workaround, implement input validation and parameterized queries (prepared statements) in /hematology_print.php to reject or escape the hem_id parameter. Additionally, restrict access to /hematology_print.php at the network level to trusted users only, implement Web Application Firewall (WAF) rules to detect SQL injection patterns, and enforce principle of least privilege for database accounts used by the application. Monitor database logs for suspicious SQL syntax and audit access to patient records.