CVE-2026-104609

HighCVSS 7.3/10Last modified Oct 6, 2026

Description

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file edit_accounts.php. This manipulation of the argument user_id/patient_id/physician_id/discounts_id/services_id causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-10461010.0A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /bo CVE-2026-1046119.1A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the CVE-2026-1046124.3A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/c CVE-2026-1046136.3A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /Simp CVE-2026-1046146.3A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /S CVE-2026-1046175.1There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc acc CVE-2026-1046186.2On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, ho CVE-2026-1046256.3A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index CVE-2026-1046268.8A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that i CVE-2026-1046275.4The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in CVE-2026-1046286.5Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with CVE-2026-1046298.8A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to l