Is there a public PoC exploit available for CVE-2026-7631?

Yes, a public proof-of-concept exploit is available for CVE-2026-7631. Prioritise patching immediately. EPSS: 0.0%.

Online Hospital Management System CVE-2026-7631

Q: What is the CVSS score of CVE-2026-7631?

CVE-2026-7631 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26793 LOW

Improper Authorization (CWE-285)

2026-05-02 VulDB

Authentication Bypass Online Hospital Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 14:30 vuln.today

Severity Changed

May 02, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

May 02, 2026 - 14:22 NVD

5.4 (MEDIUM) 2.1 (LOW)

PoC Detected

May 02, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

May 02, 2026 - 14:00 euvd

EUVD-2026-26793

Analysis Generated

May 02, 2026 - 14:00 vuln.today

CVE Published

May 02, 2026 - 13:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the component Registration Handler. The manipulation of the argument Username results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Improper authorization in code-projects Online Hospital Management System 1.0 allows authenticated remote attackers to manipulate the Username parameter in the Registration Handler, bypassing access controls and modifying user authorization. The vulnerability requires valid authentication credentials but results in integrity impact to user accounts. Publicly available exploit code exists for this vulnerability.

Technical ContextAI

The vulnerability resides in the Registration Handler component of a web-based hospital management application. CWE-285 (Improper Authorization) indicates the root cause is a failure to enforce proper access controls when processing user input, specifically the Username parameter. The attack vector is network-accessible (AV:N), suggesting the vulnerable endpoint is exposed over HTTP(S). The integrity impact (VI:L) suggests attackers can modify user data or account properties, while the availability impact (VA:L) indicates potential service degradation. The vulnerability affects the application across all versions in the 1.0 branch based on the CPE specification.

RemediationAI

No vendor-released patch identified at time of analysis. Code-projects should issue an urgent security update addressing the Registration Handler component to enforce proper authorization checks on the Username parameter. Until patching is available, implement network-level controls to restrict access to the Registration Handler endpoint to trusted administrator networks only, and enforce strong authentication policies to ensure compromised credentials are rapidly detected. Additionally, implement input validation and whitelist controls on the Username parameter to reject unauthorized modification attempts, though this should not be relied upon as a sole mitigation. Monitor access logs for suspicious registration activity and consider temporarily disabling user self-registration functionality if the vulnerable feature is not business-critical. Organizations should contact code-projects directly via https://code-projects.org/ to request security updates and detailed fix guidance.