CVE-2026-111990: kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqliquery of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates no privileges or user interaction are required, and the attack can be launched remotely.
Which deployments are potentially affected?
Hospital Management System deployments at or before commit 777fda46b77a820977a5ba616283dbfbc40bf7e1 are potentially affected where the Appointment Cancellation Handler in admin-panel.php is exposed.
How mature is the exploitation risk?
A public exploit is available and may be used in attacks. The issue was reported to the project, but no response has been recorded.