CVE-2026-111990
7.3HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote unauthenticated attackers can extract, alter, or delete database contents via SQL injection. A public exploit is available.
Root cause
The Appointment Cancellation Handler in admin-panel.php passes the unvalidated 'ID' parameter straight into a mysqli_query call.
Affected systems
kishan0725 Hospital Management System through commit 777fda46b77a820977a5ba616283dbfbc40bf7e1.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No fixed version is available yet from the maintainer. Restrict network access to admin-panel.php or patch the script to use parameterized queries with prepared statements for the 'ID' parameter.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.