Hospital Management System Project vulnerabilities

We track 8 vulnerabilities in Hospital Management System Project products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 22, 2024.

8vulnerabilities

6critical

2high

0exploited

9.2average CVSS score

Latest Hospital Management System Project vulnerabilities

9.8 Critical severity
hospital_management_system: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-40502Jul 22, 2024Hospital Management System ProjectEPSS 1.29%
SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click function of the Loginpage.aspx
7.6 High severity
hospital_management_system: Authorization Bypass Through User-Controlled Key
CVE-2024-28320Apr 29, 2024Hospital Management System Project
Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php.
9.8 Critical severity
Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-48120Jan 20, 2023Hospital Management System Project
SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php.
9.8 Critical severity
Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-38637Sep 13, 2022Hospital Management System ProjectEPSS 6.22%
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.
7.5 High severity
Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-30012May 16, 2022Hospital Management System ProjectEPSS 1.77%
In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection.
9.8 Critical severity
Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-30449May 11, 2022Hospital Management System ProjectEPSS 1.67%
Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in room.php.
9.1 Critical severity
Hospital Management System: Missing Authorization
CVE-2022-26546Mar 31, 2022Hospital Management System ProjectEPSS 1.41%
Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin password.
9.8 Critical severity
Hospital Management System: Unrestricted Upload of File with Dangerous Type
CVE-2022-24136Mar 31, 2022Hospital Management System ProjectEPSS 1.88%
Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it.