The vulnerability CVE-2026-10208 affects the Online Hospital Management System by code-projects, specifically in the login_user function within login_1.php. An attacker can remotely manipulate the Username parameter to perform SQL injection attacks, potentially compromising the backend database. The CVSS 4.0 base score is 6.9 (medium severity) with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been released, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This can lead to unauthorized data access or modification. The impact is rated medium based on CVSS 4.0 scoring, indicating limited but significant risk to confidentiality, integrity, and availability of the system data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual login attempts may help detect exploitation attempts, but no vendor-provided mitigation or official fix is currently available.