CVE-2021-36351

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear parameters in GET requests sent to /modules/nursing/nursing-station.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36351Third Party Advisory
https://www.exploit-db.com/exploits/50165Exploit, Third Party Advisory, VDB Entry
https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36351Third Party Advisory
https://www.exploit-db.com/exploits/50165Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-363525.4Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST reques CVE-2021-363569.8KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts a CVE-2021-363579.8An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uint16_t "year" value, CVE-2021-363598.8OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platyp CVE-2021-36364.6It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional CVE-2021-363639.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.CVE-2021-363649.8Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.CVE-2021-363659.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.CVE-2021-363669.8Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.CVE-2021-363678.1PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it CVE-2021-363683.7An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=v CVE-2021-363697.5An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-