# CVE-2026-10209: code-projects Online Hospital Management System SQL injection in appointmentdetail.php

Source: https://junglewise.ai/threats/cve-2026-10209-code-projects-online-hospital-management-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10209 · Severity: medium · CVSS 6.3 · Published 2026-06-01

The Online Hospital Management System, a platform used for managing medical facility operations, contains a security flaw in its appointment handling component. An attacker can exploit this to gain unauthorized access to the underlying database, potentially leading to the exposure of sensitive patient records or the modification of appointment data. This could disrupt hospital operations and compromise patient privacy.

Technologies: [Code-Projects Online Hospital Management System](https://junglewise.ai/threats/technologies/online-hospital-management-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-10209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10209 being exploited in the wild.

**How severe is CVE-2026-10209?** Medium severity, with a CVSS score of 6.3, published 1 June 2026.

**Which products and versions are affected?** Code-Projects Online Hospital Management System 1.0.

**Is there a fix for CVE-2026-10209?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10209 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10209?** Check whether you run Code-Projects Online Hospital Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in code-projects Online Hospital Management System 1.0 within the 'appointmentdetail.php' file. The root cause is the improper neutralization of the 'editid' GET parameter before it is used in a database query. A remote attacker can provide crafted SQL payloads (including boolean-based, error-based, and time-based blind techniques) to manipulate queries. This allows for unauthorized database access, data extraction, and potential modification of records. While some reports suggest low privileges are required, the researcher's disclosure indicates the vulnerability may be exploitable without authentication. No official patch is currently available; users are advised to implement prepared statements and input validation.

## Affected products

- code-projects Online Hospital Management System 1.0

## Timeline

- 2026-05-10: disclosed: Initial researcher disclosure on GitHub
- 2026-05-31: advisory: VulDB advisory published
- 2026-06-01: advisory: NVD publication date

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/Wanghuidi/CVE/issues/1](https://github.com/Wanghuidi/CVE/issues/1)
- [https://vuldb.com/cve/CVE-2026-10209](https://vuldb.com/cve/CVE-2026-10209)
- [https://vuldb.com/submit/824988](https://vuldb.com/submit/824988)
- [https://vuldb.com/vuln/367488](https://vuldb.com/vuln/367488)
- [https://vuldb.com/vuln/367488/cti](https://vuldb.com/vuln/367488/cti)

## Related threats

- [code-projects Online Hospital Management System IDOR in viewdoctortimings.php](https://junglewise.ai/threats/cve-2026-10299-code-projects-online-hospital-management-system-idor-in)
- [code-projects Online Hospital Management System SQL injection in login_1.php](https://junglewise.ai/threats/cve-2026-10208-code-projects-online-hospital-management-system-sql-injection-in)
- [code-projects Online Hospital Management System SQL injection in patient.php](https://junglewise.ai/threats/cve-2026-10186-code-projects-online-hospital-management-system-sql-injection-in)