CVE-2026-6005

MediumCVSS 6.3

Published: 10/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function of the file /hematology_print.php. Executing a manipulation of the argument hem_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Risk Assessment

A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion of patient data.

Recommendation

Apply the vendor patch or mitigation as soon as possible; if no update is available, consider disabling the vulnerable file or implementing input filtering (WAF).

Other vulnerabilities in code-projects Patient Record Management System

CVE-2026-6006Medium
A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS