Which versions of Hospital Management System are affected by CVE-2026-8785?

CVE-2026-8785 is a SQL injection vulnerability in projectworlds Hospital Management System PHP 1.0 that allows unauthenticated attackers to directly access and modify patient records, creating…

Is there a public PoC exploit available for CVE-2026-8785?

Yes, a public proof-of-concept exploit is available for CVE-2026-8785. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-8785?

Within 24 hours: Audit all instances of projectworlds Hospital Management System PHP 1.0 in production; restrict network access to update_info.php to trusted internal networks only; enable database query logging. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the appointment_no parameter; conduct forensic review of appointment and patient data modification logs for unauthorized access. Within 30 days: Evaluate migration to alternative hospital management solutions with active vendor support; if retention is necessary, deploy a reverse proxy with input validation and parameterized query enforcement in front of the vulnerable application.

Hospital Management System CVE-2026-8785

Q: What is the CVSS score of CVE-2026-8785?

CVE-2026-8785 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30729 MEDIUM

SQL Injection (CWE-89)

2026-05-18 VulDB

GHSA-jhq7-r7p6-3g3j

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 18, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

May 18, 2026 - 04:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 18, 2026 - 03:44 vuln.today

DescriptionCVE.org

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in projectworlds Hospital Management System in PHP 1.0 enables unauthenticated remote attackers to extract or modify patient data through the appointment_no parameter in update_info.php. The vulnerability has publicly available exploit code and affects the getAllPatientDetail function, with the vendor notified but unresponsive.

Technical ContextAI

The vulnerability affects projectworlds Hospital Management System in PHP version 1.0, a web-based healthcare application. The flaw is a classic SQL injection (CWE-89) where user input from the appointment_no GET parameter is directly incorporated into SQL queries without proper sanitization in the getAllPatientDetail function within update_info.php. This allows attackers to inject arbitrary SQL commands that execute in the context of the database connection.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was notified via GitHub issue but remains unresponsive. Immediate mitigation requires either replacing the vulnerable software or implementing web application firewall (WAF) rules to block SQL injection patterns in the appointment_no parameter. If continued use is necessary, implement input validation for the appointment_no field to accept only numeric values, parameterize all SQL queries in update_info.php, and restrict database user permissions to minimum required operations. Monitor logs for exploitation attempts targeting update_info.php with suspicious appointment_no values.