CVE-2026-8785: projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8785?
CVE-2026-8785 has been classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2026-8785?
To fix CVE-2026-8785, you should sanitize and validate all user input in the getAllPatientDetail function of update_info.php.
What systems are affected by CVE-2026-8785?
CVE-2026-8785 affects version 1.0 of the ProjectWorlds hospital management system in PHP.
What kind of attack does CVE-2026-8785 expose systems to?
CVE-2026-8785 exposes systems to SQL injection attacks, which can lead to unauthorized database access.
Is there a patch available for CVE-2026-8785?
As of now, no official patch has been released for CVE-2026-8785, so implementing input validation is crucial.