CVE-2026-10299: code-projects Online Hospital Management System viewdoctortimings.php resource injection
A weakness has been identified in code-projects Online Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. This manipulation of the argument delid causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
code-projects Online Hospital Management System 1.0from your environment.If the application is not required, remove or take the affected instance offline until a vendor-supplied fix is available.
- Configuration
Implement strict server-side input validation and authorization for the 'delid' parameter: validate type/format, sanitize input, and enforce per-user access control so a user can only act on resources they are authorized to manage (prevent IDOR).
viewdoctortimings.php (code-projects Online Hospital Management System 1.0) delid parameter handling / authorization = server-side validation and authorization enforced - Compensating control
Restrict access to viewdoctortimings.php and related management endpoints until a vendor patch is available: apply network controls (firewall, ACLs) or place behind a VPN/WAF and limit access to trusted administrative IP addresses.
- Operational
Monitor and review logs for attempts to misuse the 'delid' parameter, investigate suspicious activity, and follow incident response procedures if exploitation is detected. Apply fixes as soon as a vendor patch is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10299?
The severity of CVE-2026-10299 is classified as low with a score of 3.8.
How do I fix CVE-2026-10299?
To fix CVE-2026-10299, ensure proper validation and sanitation of the 'delid' argument in the viewdoctortimings.php file.
What systems are affected by CVE-2026-10299?
CVE-2026-10299 affects version 1.0 of the code-projects Online Hospital Management System.
What type of vulnerability is CVE-2026-10299?
CVE-2026-10299 is a resource injection vulnerability that arises due to improper control of resource identifiers.
Can CVE-2026-10299 be exploited remotely?
Yes, CVE-2026-10299 can be initiated remotely, allowing an attacker to manipulate the 'delid' argument.