CVE-2026-85397: SQL Injection in code-projects Hospital Information System

The vulnerability CVE-2026-85397 affects code-projects Hospital Information System 1.0. It is a SQL injection issue in the findBySearch function within addReq.php, triggered by improper handling of the Search parameter. This allows remote attackers to execute arbitrary SQL commands by manipulating this argument. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. No known exploits are reported in the wild, and no official remediation or patch has been provided as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute unauthorized SQL queries on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries to mitigate SQL injection risks in the affected function. Monitor vendor channels for updates regarding patches or official mitigations.