What is the CVSS score of CVE-2026-85399?

CVE-2026-85399 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-85399?

Yes, a public proof-of-concept exploit is available for CVE-2026-85399. Prioritise patching immediately. EPSS: 0.3%.

Hospital Information System CVE-2026-85399

EUVD-2026-70867 MEDIUM

SQL Injection (CWE-89)

2026-09-04 VulDB

GHSA-mvj6-g22q-4pr3

PHP SQLi Hospital Information System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify internet-facing Hospital Information System instance
Exploit

Send crafted HTTP request with SQL payload in ID parameter
Execution

getSinglePresp passes unsanitized ID into SQL query
Impact

Extract patient records or credentials via UNION/error-based SQLi

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions are required - the vulnerable endpoint is exposed over the network with no authentication prerequisite (CVSS 4.0 PR:N, UI:N, AC:L). Any network-reachable instance of Hospital Information System 1.0 is exploitable by sending a crafted HTTP request with a malicious `ID` parameter to `includes/presp/PrespController.php`. The sole limiting factor is network reachability: if the application is deployed on an internet-facing server, exploitation is trivially automated. Deployments restricted behind a LAN, VPN, or firewall are protected from remote exploitation.
Impact	The CVSS 4.0 score of 5.5 with E:P (exploit publicly available) represents a meaningful real-world risk despite the moderate score. The impact metrics VC:L/VI:L/VA:L in the 4.0 vector appear conservative for a SQL injection - typical SQLi in a PHP application permits full database enumeration (UNION-based or error-based extraction), which would expose patient medical records, credentials, and PII stored in the hospital system. The CVSS 4.0 limited-impact scoring may reflect the specific injection point being a single stored-procedure-style query rather than a stacked-query or out-of-band vector. No CISA KEV listing is present, suggesting no confirmed widespread active exploitation. However, a public GitHub PoC (referenced in the exploit tag) significantly lowers the attack complexity in practice. The product's deployment in healthcare contexts elevates the consequence of even partial data disclosure given HIPAA/GDPR-equivalent sensitivities around patient data.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted HTTP GET or POST request to `PrespController.php` with a SQL payload in the `ID` parameter (e.g., `ID=1 UNION SELECT username,password,3 FROM users--`). The application passes the unsanitized value directly into the SQL query, returning database rows containing patient records or administrator credentials. A public PoC on GitHub provides a ready-made payload, enabling script-kiddie-level exploitation with no specialized knowledge.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 04, 2026

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the ID parameter of the getSinglePresp function in includes/presp/PrespController.php. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CPE wildcard and absence of a fix version in any reference confirm no patched release exists. Operators should immediately disable or restrict public access to the PrespController.php endpoint, blocking network access to the getSinglePresp function via web server ACLs or WAF rules targeting SQL metacharacter injection patterns in the ID parameter (note: WAF rules may be bypassed by encoding variations and are not a complete fix). As a more robust compensating control, place the application behind a VPN or IP allowlist so only authorized clinical staff can reach it, eliminating the unauthenticated network attack surface. The underlying fix requires refactoring getSinglePresp to use PHP PDO or MySQLi prepared statements with bound parameters. VulDB reports are available at https://vuldb.com/vuln/398542 and the public PoC is documented at https://github.com/lccc-t/CVE/issues/4.

Affected VersionsENISA

Hospital Information System 1.0

Affected Packages

euvd hospital_information_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected product is a PHP-based hospital management system published by code-projects.org (CPE: cpe:2.3:a:code-projects:hospital_information_system:*:*:*:*:*:*:*:*), commonly deployed in small clinics and educational environments. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands): the getSinglePresp function in PrespController.php constructs a SQL query incorporating the user-supplied ID argument without adequate sanitization or parameterization. This is a classic unsanitized input concatenation pattern endemic to legacy PHP codebases lacking prepared statements. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is remotely exploitable with no authentication or special conditions required.

Know when Hospital Information System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 8.2 HIGH

Unauthenticated network SQLi typically permits full DB read (C:H); limited write via single parameterized endpoint (I:L); no availability impact expected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Sep 04, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Sep 04, 2026 - 02:30 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Prevalence

Low

educational/demo PHP project, niche small-clinic deployments

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.