Is CVE-2026-105385 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105385 being exploited in the wild.

How severe is CVE-2026-105385?

High severity, with a CVSS score of 7.3, published 5 October 2026.

Which products and versions are affected?

Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.

Is there a fix for CVE-2026-105385?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105385 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105385?

Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105385: onetwothreeneth HospitalManagementSystem SQL injection in transaction_details.php

CVE-2026-105385 · Severity: high · CVSS 7.3 · Published 2026-10-05

A hospital management system used to track patient transactions and medical billing contains a SQL injection vulnerability in its transaction details page. An attacker can remotely exploit this without authentication to extract sensitive patient data, healthcare records, and login credentials from the database, or corrupt financial transaction records.

Technologies: Onetwothreeneth HospitalManagementSystem. Vendors: Onetwothreeneth.

Quick answers

Is CVE-2026-105385 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105385 being exploited in the wild.
How severe is CVE-2026-105385?: High severity, with a CVSS score of 7.3, published 5 October 2026.
Which products and versions are affected?: Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.
Is there a fix for CVE-2026-105385?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105385 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105385?: Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-based blind SQL injection exists in transaction_details.php where the GET parameter transaction_id is concatenated directly into multiple SELECT and UPDATE SQL queries without parameterization or escaping. The vulnerability is reachable without authentication due to ineffective session validation, and an attacker can extract the entire database or manipulate transaction records via injected SQL clauses in the transaction_id parameter.

Affected products

onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d

Timeline

2026-09-15: disclosed: Issue #10 reported on GitHub
2026-10-05: advisory: CVE-2026-105385 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.