Threats tagged 'ghsa-qv49-5v4g-3xgh'

CVE-2026-104609 is a SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting the get function in edit_accounts.php. The vulnerability arises from manipulation of parameters such as user_id, patient_id, physician_id, discounts_id, and services_id. Remote exploitation is possible, and a public exploit is available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor has not yet responded to the issue report.