CVE-2026-105384: SQL Injection in UNION HospitalManagementSystem

This vulnerability in UNION HospitalManagementSystem involves an SQL injection via the patient_id argument in an unspecified function within patient_info.php. The injection allows remote attackers to execute unauthorized SQL commands. The product's rolling release strategy means affected versions cannot be precisely enumerated. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although an exploit is publicly available, there is no evidence of active exploitation in the wild. The vendor has not issued a patch or official response as of the publication date.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the HospitalManagementSystem database. The impact is rated medium severity based on the CVSS score. No confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official UNION communications for updates. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting patient_id parameters.