CVE-2026-6006

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
code-projectsPatient Record Management System1.0

References

Timeline

Published
Apr 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-600605.1Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm ProjecCVE-2026-600626.4The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designaCVE-2026-600637.0An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCVE-2026-600655.3When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthentCVE-2026-60076.3A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The manCVE-2026-600735.9An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can leCVE-2026-600747.5Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. CVE-2026-600757.5Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_timCVE-2026-60086.8Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and AdvertiCVE-2026-600807.3Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. ACVE-2026-600817.5DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocatCVE-2026-600829.1DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but th
CVE-2026-6006: Medium severity, CVSS 6.3 | Vulnix