Patient Record Management System
Monthly
SQL injection in code-projects Patient Record Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_hpatient.php, leading to unauthorized data access, modification, and potential denial of service. Publicly available exploit code exists (CVSS 6.3, attack vector network, low complexity, requires valid credentials). This is not confirmed as actively exploited by CISA but poses immediate risk given public POC availability and low exploitation complexity.
SQL injection in code-projects Patient Record Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the hem_id parameter in /hematology_print.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 6.3 (medium) with publicly available exploit code, though no CISA KEV confirmation indicates active widespread exploitation at time of analysis.
Information disclosure in code-projects Patient Record Management System 1.0 allows unauthenticated remote attackers to access sensitive patient data via manipulation of the SQL database backup file (/db/hcpms.sql), with publicly available exploit code and user interaction required. The vulnerability affects the SQL Database Backup File Handler component and has moderate CVSS impact (4.3) but is elevated by public exploit availability and the sensitivity of healthcare data exposure.
SQL injection in Patient Record Management System 1.0 via the comp_id parameter in /fecalysis_not.php enables authenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but no user interaction.
SQL injection in Patient Record Management System 1.0 via the itr_no parameter in /xray_form.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. The vulnerability requires valid user credentials (PR:L) but can be exploited remotely over the network. Public exploit code is available, though real-world exploitation risk remains low given the EPSS score of 0.04% and limited scope of impact (local scope only, no confidentiality/integrity/availability impact to the system itself).
SQL injection in CodeAstro Patient Record Management System 1.0 allows unauthenticated remote attackers to manipulate the login process via the 'uname' parameter in /login.php. Public exploit code is available, but no active exploitation has been reported, and EPSS score indicates low probability of exploitation (0.06%).
Cross-site request forgery in Patient Record Management System 1.0 allows remote attackers to perform unauthorized actions by tricking an authenticated user into clicking a malicious link. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. The EPSS score of 0.07% indicates a very low probability of widespread exploitation.
Cross-site scripting (XSS) in CodeAstro Patient Record Management System 1.0 allows an authenticated high-privilege user to inject arbitrary JavaScript via the Patient Name/Name argument on the Generate New Report Page. Publicly available exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating low exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the itr_no parameter in /urinalysis_record.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or manipulate database contents via the itr_no parameter in /view_dental.php. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.04%), indicating limited exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no or comp_id parameters in /birthing.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.04%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no parameter in view_hematology.php. A public exploit exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.04%), suggesting limited real-world risk.
SQL injection in Health Center Patient Record Management System 1.0 allows authenticated attackers to manipulate database queries via the itr_no parameter in /birthing_record.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.04%), indicating limited exploitation likelihood.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file urinalysis_form.php. The manipulation of the argument urinalysis_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /sputum_form.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Patient Record Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_hpatient.php, leading to unauthorized data access, modification, and potential denial of service. Publicly available exploit code exists (CVSS 6.3, attack vector network, low complexity, requires valid credentials). This is not confirmed as actively exploited by CISA but poses immediate risk given public POC availability and low exploitation complexity.
SQL injection in code-projects Patient Record Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the hem_id parameter in /hematology_print.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 6.3 (medium) with publicly available exploit code, though no CISA KEV confirmation indicates active widespread exploitation at time of analysis.
Information disclosure in code-projects Patient Record Management System 1.0 allows unauthenticated remote attackers to access sensitive patient data via manipulation of the SQL database backup file (/db/hcpms.sql), with publicly available exploit code and user interaction required. The vulnerability affects the SQL Database Backup File Handler component and has moderate CVSS impact (4.3) but is elevated by public exploit availability and the sensitivity of healthcare data exposure.
SQL injection in Patient Record Management System 1.0 via the comp_id parameter in /fecalysis_not.php enables authenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but no user interaction.
SQL injection in Patient Record Management System 1.0 via the itr_no parameter in /xray_form.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. The vulnerability requires valid user credentials (PR:L) but can be exploited remotely over the network. Public exploit code is available, though real-world exploitation risk remains low given the EPSS score of 0.04% and limited scope of impact (local scope only, no confidentiality/integrity/availability impact to the system itself).
SQL injection in CodeAstro Patient Record Management System 1.0 allows unauthenticated remote attackers to manipulate the login process via the 'uname' parameter in /login.php. Public exploit code is available, but no active exploitation has been reported, and EPSS score indicates low probability of exploitation (0.06%).
Cross-site request forgery in Patient Record Management System 1.0 allows remote attackers to perform unauthorized actions by tricking an authenticated user into clicking a malicious link. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. The EPSS score of 0.07% indicates a very low probability of widespread exploitation.
Cross-site scripting (XSS) in CodeAstro Patient Record Management System 1.0 allows an authenticated high-privilege user to inject arbitrary JavaScript via the Patient Name/Name argument on the Generate New Report Page. Publicly available exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating low exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the itr_no parameter in /urinalysis_record.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or manipulate database contents via the itr_no parameter in /view_dental.php. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.04%), indicating limited exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no or comp_id parameters in /birthing.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.04%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no parameter in view_hematology.php. A public exploit exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.04%), suggesting limited real-world risk.
SQL injection in Health Center Patient Record Management System 1.0 allows authenticated attackers to manipulate database queries via the itr_no parameter in /birthing_record.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.04%), indicating limited exploitation likelihood.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file urinalysis_form.php. The manipulation of the argument urinalysis_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /sputum_form.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.