PT-2026-41633 · Unknown · Hospital Management System In Php

Luther · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-8785

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hospital-management-system-in-php version 1.0

Description A remote SQL injection flaw exists in the GET Parameter Handler component. The issue occurs within the getAllPatientDetail() function located in the update info.php file, where manipulation of the appointment no parameter allows for the execution of arbitrary SQL commands.

Recommendations As a temporary workaround, restrict access to the update info.php file or avoid using the appointment no parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-8785

Affected Products

Hospital Management System In Php

References · 9

• 🔥 https://github.com/lutherping/CVE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8785 · Security Note
• https://github.com/projectworldsofficial/Hospital-management-system-in-php/issues/8 · Note
• https://twitter.com/VulmonFeeds/status/2056233232169894380 · Twitter Post
• https://vuldb.com/vuln/364409 · Note
• https://vuldb.com/vuln/364409/cti · Note
• https://twitter.com/CVEnew/status/2056253245157151080 · Twitter Post
• https://t.me/cveNotify/163814 · Telegram Post
• https://vuldb.com/submit/812010 · Note