Hospitals Patient Records EUVD-2026-35035

No special conditions are required for exploitation - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against any network-accessible deployment of SourceCodester Hospitals Patient Records Management System. The only limiting factors are: (1) the application must be reachable over the network by the attacker, and (2) the /classes/Master.php?f=save_patient endpoint must be accessible - both are expected in a default deployment. No specific non-default configuration, authenticated session, or user interaction is required. The wildcard CPE version field suggests no version is known to be exempt. The primary practical barrier to mass exploitation is the relative obscurity of the SourceCodester product compared to mainstream healthcare platforms.

The CVSS 4.0 base score of 5.5 reflects low impact ratings across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) on the vulnerable component, with no downstream system impact (SC:N/SI:N/SA:N). However, this score understates practical risk in the healthcare context: the attack vector is fully network-accessible (AV:N), requires no complexity (AC:L), no prerequisites (AT:N), no privileges (PR:N), and no user interaction (UI:N), placing it in the most accessible threat tier for remote exploitation. The CVSS E:P modifier confirms proof-of-concept exploit code is publicly available, referenced via a GitHub issue. EPSS data was not provided, so exploitation probability cannot be quantified numerically. KEV status is negative - active exploitation by threat actors has not been confirmed by CISA. The combination of unauthenticated remote access, a public POC, and a healthcare patient records target makes this a meaningful priority for any organization running this system, even if the raw CVSS score appears moderate.

An unauthenticated remote attacker identifies an internet-exposed instance of the Hospitals Patient Records Management System and sends a crafted HTTP request to /classes/Master.php?f=save_patient with a malicious SQL payload in the ID parameter. Because a public POC exists (referenced at https://github.com/showmesvg/horized/issues/1), the attacker can adapt existing exploit code to enumerate database tables and extract patient records, including personally identifiable and medical information. The lack of authentication and low attack complexity means this can be automated and executed at scale against any exposed deployment.