Threats Tagged 'cve-2026-105385'

A SQL injection vulnerability exists in the onetwothreeneth HospitalManagementSystem in the file transaction_details.php via manipulation of the transaction_id parameter. The vulnerability can be exploited remotely without authentication. The project uses a rolling release system, so affected or fixed versions are not disclosed. The issue was reported but not yet addressed by the vendor. The vulnerability has a CVSS score of 7.3, indicating a medium severity level.

CVE-2026-105385 is a medium severity SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting an unknown functionality in the file transaction_details.php. The vulnerability arises from improper sanitization of the transaction_id argument, allowing remote attackers to execute SQL injection attacks. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, but no known active exploitation in the wild has been reported.