What’s Vulnerable › Vulnerabilities

CVE-2026-85397: code-projects Hospital Information System addReq.php findBySearch sql injection

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-04
• Weakness: CWE-74

Description

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected products

• code-projects Hospital Information System: 1.0

References

• https://code-projects.org/
• https://github.com/lccc-t/CVE/issues/2
• https://vuldb.com/cve/CVE-2026-85397
• https://vuldb.com/submit/894858
• https://vuldb.com/vuln/398540
• https://vuldb.com/vuln/398540/cti

Get alerted when CVE-2026-85397 or the next vulnerability affects your stack