SourceCodester HPRMS EUVD-2026-33507

Q: What is the CVSS score of EUVD-2026-33507?

EUVD-2026-33507 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10185 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-31 cna@vuldb.com

GHSA-2hf5-r849-3x76

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 31, 2026 - 14:31 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester Hospitals Patient Records Management System 1.0. Affected is an unknown function of the file /classes/Users.php?f=save. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Hospitals Patient Records Management System 1.0 exposes sensitive medical data to unauthenticated remote attackers through the ID parameter of the /classes/Users.php?f=save endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote access requiring no credentials or user interaction, and a publicly available proof-of-concept exploit (E:P) further elevates real-world risk beyond the moderate 5.5 base score. No vendor-released patch has been identified, leaving all known deployments of version 1.0 exposed to data exfiltration and manipulation of patient health records.

Technical ContextAI

The affected application is a PHP-based hospital patient records management system distributed by SourceCodester, a platform known for distributing open-source academic and small-business web applications typically built on PHP and MySQL. The vulnerable code path resides in /classes/Users.php, a user management handler invoked with the query parameter f=save. The root cause is classified under CWE-74 (Injection), specifically SQL injection, where the ID parameter is concatenated unsanitized into a database query rather than being handled via parameterized prepared statements. No CPE string was included in the available data, but the vendor site (sourcecodester.com) is referenced, confirming the affected product and version as 1.0. The lack of input sanitization in a user-facing save function is a common defect in rapidly developed academic-grade PHP applications distributed via SourceCodester.

RemediationAI

No vendor-released patch has been identified at the time of analysis - monitor VulDB entry vuldb.com/vuln/367466 and sourcecodester.com for any future fix release. As an immediate compensating control, restrict network access to the /classes/Users.php endpoint via firewall rules or a web application firewall (WAF) configured to block requests carrying SQL metacharacters in the ID parameter; note that WAF rules may produce false positives on legitimate numeric ID values if not carefully tuned. If the application cannot be taken offline, place it behind VPN-only access to eliminate public internet exposure - this eliminates the AV:N attack vector entirely at the cost of administrative overhead for remote users. Developers with access to the source code should replace any raw string concatenation in the SQL query with parameterized prepared statements (PDO or MySQLi), which resolves the root cause. If none of these controls are immediately feasible, consider disabling the f=save function path temporarily until a code fix is applied.