CVE-2026-76574
HighCVSS 7.3Summary
A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Risk Assessment
An attacker could gain unauthorized access to the system, take over user accounts, or steal sensitive medical data.
Recommendation
Apply vendor-provided patches or restrict access to the system, and use parameterized queries to prevent SQL injection.
Original NVD description (English source)
A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.