Is CVE-2026-10299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10299 being exploited in the wild.

How severe is CVE-2026-10299?

Low severity, with a CVSS score of 3.8, published 1 June 2026.

Is there a fix for CVE-2026-10299?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10299 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-10299?

Check whether you run Code-Projects Online Hospital Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10299: code-projects Online Hospital Management System IDOR in viewdoctortimings.php

CVE-2026-10299 · Severity: low · CVSS 3.8 · Published 2026-06-01

A vulnerability exists in the Online Hospital Management System, a web application used for managing medical facility operations. An attacker can exploit this flaw to delete doctor schedule records that do not belong to them. This can lead to significant operational disruption, including the loss of appointment data and conflicts in hospital scheduling.

Technologies: Code-Projects Online Hospital Management System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-10299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10299 being exploited in the wild.
How severe is CVE-2026-10299?: Low severity, with a CVSS score of 3.8, published 1 June 2026.
Which products and versions are affected?: Code-Projects Online Hospital Management System 1.0.
Is there a fix for CVE-2026-10299?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10299 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-10299?: Check whether you run Code-Projects Online Hospital Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the 'viewdoctortimings.php' file of the Online Hospital Management System 1.0. The application fails to perform ownership or authorization checks when processing the 'delid' GET parameter used for deleting doctor timing records. An attacker can manipulate this parameter to delete arbitrary records from the 'doctor_timings' database table. While the reported CVSS indicates high privileges are required, the technical analysis suggests the endpoint may lack session validation entirely, potentially allowing unauthenticated remote attackers to perform mass deletion of schedule data via IDOR enumeration.

Affected products

code-projects Online Hospital Management System 1.0

Timeline

2026-06-01: disclosed
2026-06-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.