CVE-2026-86302: Information Disclosure in code-projects Hospital Information System
Description
A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS v4.0
Score 6.9medium
Affected software
code-projects
Hospital Information System
pkg:github/code-projects/hospital_information_systemcpe:2.3:a:code-projects:hospital_information_system:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects code-projects Hospital Information System 1.0 and is located in an unspecified functionality of the /HIS/his.sql file, which handles SQL database backups. An attacker can manipulate this component remotely without privileges or user interaction to cause information disclosure. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. Exploit code is publicly available, but there are no known exploits in the wild. No patch or remediation information is provided.
Potential Impact
Successful exploitation allows remote attackers to disclose information from the system, which could lead to further attacks or data leakage. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector. There is no indication of integrity or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected system and monitoring for suspicious activity related to the SQL Database Backup File Handler.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-06T16:37:10.068Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9eb02facd9273b499cf46d
Added to database: 09/07/2026, 12:38:07 UTC
Last enriched: 09/15/2026, 00:37:26 UTC
Last updated: 10/22/2026, 13:15:24 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.