Threat database

CVE-2026-105386 is a SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting the get function in print.php via the transaction_id parameter. The vulnerability allows remote attackers to inject SQL commands. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early but remains unaddressed. The CVSS 4.0 score is 6.9, indicating medium severity.

CVE-2026-105385 is a medium severity SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting an unknown functionality in transaction_details.php. The vulnerability allows remote attackers to manipulate the transaction_id parameter to perform SQL injection. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The issue was reported early but has not yet received a vendor response or patch. Public exploit code has been disclosed.

CVE-2026-105383 is a SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting an unknown function in php/controller.php. The vulnerability arises from manipulation of the transaction_idS argument and can be exploited remotely without authentication. The project uses a rolling release model, so specific affected or fixed versions are not available. The vulnerability has been publicly disclosed, but no vendor response or patch is currently known. The CVSS 4.0 score is 6.9, indicating medium severity.

A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user_id causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation of the argument img can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-104609 is a SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting the get function in edit_accounts.php. The vulnerability arises from manipulation of parameters such as user_id, patient_id, physician_id, discounts_id, and services_id. Remote exploitation is possible, and a public exploit is available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor has not yet responded to the issue report.