Is there a public PoC exploit available for CVE-2026-7632?

Yes, a public proof-of-concept exploit is available for CVE-2026-7632. Prioritise patching immediately. EPSS: 0.0%.

Online Hospital Management System CVE-2026-7632

Q: What is the CVSS score of CVE-2026-7632?

CVE-2026-7632 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26794 MEDIUM

SQL Injection (CWE-89)

2026-05-02 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 02, 2026 - 20:15 vuln.today

Public exploit code

Analysis Generated

May 02, 2026 - 14:30 vuln.today

Severity Changed

May 02, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

May 02, 2026 - 14:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

May 02, 2026 - 14:00 euvd

EUVD-2026-26794

Analysis Generated

May 02, 2026 - 14:00 vuln.today

CVE Published

May 02, 2026 - 13:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Online Hospital Management System 1.0 allows remote unauthenticated attackers to manipulate the delid parameter in /viewappointment.php, enabling database queries with limited confidentiality and integrity impact. The vulnerability is publicly disclosed with available exploit code and poses a network-accessible risk to unpatched deployments.

Technical ContextAI

The vulnerability exists in a PHP-based hospital management application where user input via the delid parameter in /viewappointment.php is passed unsanitized to SQL queries, violating input validation practices (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The attack leverages HTTP GET/POST parameters to inject arbitrary SQL syntax. CPE cpe:2.3:a:code-projects:online_hospital_management_system indicates the affected product line from code-projects.org. The publicly disclosed exploit references time-blind SQL injection techniques, suggesting data exfiltration is possible through time-delay inference.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate actions: (1) Implement input validation and parameterized SQL queries (prepared statements) on the delid parameter in /viewappointment.php to eliminate SQL injection. (2) Apply Web Application Firewall (WAF) rules to block SQL injection payloads in request parameters. (3) Restrict direct database access to least-privilege service accounts, limiting impact if injection succeeds. (4) Upgrade to a patched version once code-projects releases a fix - check code-projects.org regularly or contact the vendor directly at the repository linked in references. (5) As interim measure, require authentication for /viewappointment.php access if business logic permits, reducing exposure to unauthenticated remote attackers. Monitor database logs for anomalous queries to detect exploitation attempts.