Is there a public PoC exploit available for CVE-2026-6006?

Yes, a public proof-of-concept exploit is available for CVE-2026-6006. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6006

Q: What is the CVSS score of CVE-2026-6006?

CVE-2026-6006 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21297 LOW

SQL Injection (CWE-89)

2026-04-10 VulDB

GHSA-h6p7-635q-vpx7

PHP SQLi Patient Record Management System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 04:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 03:45 euvd

EUVD-2026-21297

Analysis Generated

Apr 10, 2026 - 03:45 vuln.today

CVE Published

Apr 10, 2026 - 03:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Patient Record Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_hpatient.php, leading to unauthorized data access, modification, and potential denial of service. Publicly available exploit code exists (CVSS 6.3, attack vector network, low complexity, requires valid credentials). This is not confirmed as actively exploited by CISA but poses immediate risk given public POC availability and low exploitation complexity.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) in a PHP-based patient record management application. The flaw exists in the /edit_hpatient.php file where user-supplied input via the ID parameter is not properly sanitized before being incorporated into SQL queries. This allows an authenticated user to inject arbitrary SQL commands that execute within the database context. The affected product is code-projects Patient Record Management System version 1.0 (CPE: cpe:2.3:a:code-projects:patient_record_management_system:*:*:*:*:*:*:*:*), which appears to be a web-based healthcare information system. The vulnerability requires valid login credentials (PR:L per CVSS vector) but does not require user interaction (UI:N), making it exploitable by any authenticated application user.

RemediationAI

Immediate action: upgrade to a patched version of Patient Record Management System released by code-projects; exact patched version number not confirmed in available advisory data, so contact code-projects.org or check their release notes for the latest security update addressing SQL injection in /edit_hpatient.php. Interim workaround: implement input validation and parameterized queries (prepared statements) in the /edit_hpatient.php file to prevent SQL injection, and restrict database user permissions to read-only access where feasible. Secondary control: enforce strong authentication and multi-factor authentication for admin accounts accessing patient records to reduce lateral movement post-compromise. Consult vendor advisory at https://code-projects.org/ for official patching guidance and timeline.