CVE-2026-6006
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion of patient data.
Recommendation
Apply the vendor patch or mitigation as soon as possible; if no update is available, consider disabling the vulnerable file or implementing input filtering (WAF).
Other vulnerabilities in code-projects Patient Record Management System
Original NVD description (English source)
A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS