CVE-2026-85398: SQL Injection in code-projects Hospital Information System

The vulnerability CVE-2026-85398 affects code-projects Hospital Information System version 1.0. It is a SQL injection issue in the viewReq function of viewReq.php, where the ID parameter is not properly sanitized, allowing remote attackers to inject SQL commands. This can lead to unauthorized data access or manipulation. Exploit code is publicly available, indicating potential for exploitation, although no known active exploitation in the wild has been reported. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database privileges. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, reflecting the network attack vector, low complexity, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries on the ID argument in the viewReq function to mitigate SQL injection risks. Monitoring for updates from the vendor is advised.