CVE-2026-82914: SQL Injection in kishan0725 Hospital-Management-System

This vulnerability affects kishan0725 Hospital-Management-System version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the Contact argument in the /search.php file. The vulnerability allows unauthorized SQL commands to be executed, potentially leading to data leakage or modification. The vendor was contacted but did not provide any response or patch. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This may lead to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying manual mitigations such as input validation and parameterized queries if possible. Monitoring and restricting access to the vulnerable endpoint may reduce risk until a patch is released.