CVE-2023-41527

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-415289.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, andCVE-2023-415296.1Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lCVE-2023-41538.8The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capabilityCVE-2023-415309.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.CVE-2023-415318.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 CVE-2023-415328.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.CVE-2023-415376.1phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.CVE-2023-415386.1phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.CVE-2023-415397.5phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter.CVE-2023-41546.5A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged useCVE-2023-415429.8SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information viaCVE-2023-415439.8SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the co