High severity · published May 18, 2026
CVE-2026-8785
projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
hospital-management-system-in-php · projectworlds
1.0 · source: vendor
Affected product
HO
hospital-management-system-in-php
projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8785
github.com
https://github.com/lutherping/CVE
github.com
https://github.com/projectworldsofficial/Hospital-management-system-in-php/issues/8
vuldb.com
https://vuldb.com/submit/812010
vuldb.com
https://vuldb.com/vuln/364409
vuldb.com
https://vuldb.com/vuln/364409/cti
More from hospital-management-system-in-php
9.8
CVE-2023-5053
Hospital management system version 378c157 allows to bypass authentication
9.8
CVE-2023-5004
Hospital management system version 378c157 allows to bypass authentication
9.8
CVE-2021-43631
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php
9.8
CVE-2021-43629
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php
9.8
CVE-2021-43628
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php