CVE-2026-85398: code-projects Hospital Information System viewReq.php viewReq sql injection
A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction, according to the supplied CVSS vector. An attacker would need to be able to reach the affected application endpoint and manipulate the ID argument handled by viewReq.php.
How likely is exploitation in practice?
A public exploit is available and may be used. The vulnerability is rated high severity with low attack complexity in the provided CVSS vector.
What security impact can successful exploitation have?
The supplied CVSS vector indicates low impacts to confidentiality, integrity, and availability. The issue is a SQL injection in the ID argument processed by the viewReq function in viewReq.php.