CVE-2026-85397

EUVD-2026-70859
A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.91%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
code-projectshospital_information_system
1.0
CNA
Common Weakness Enumeration
References
https://code-projects.org/
https://github.com/lccc-t/CVE/issues/2
https://vuldb.com/cve/CVE-2026-85397
https://vuldb.com/submit/894858
https://vuldb.com/vuln/398540
https://vuldb.com/vuln/398540/cti