Is CVE-2026-105386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105386 being exploited in the wild.

How severe is CVE-2026-105386?

High severity, with a CVSS score of 7.3, published 5 October 2026.

Which products and versions are affected?

Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.

Is there a fix for CVE-2026-105386?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105386 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105386?

Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105386: onetwothreeneth HospitalManagementSystem SQL injection in print.php

CVE-2026-105386 · Severity: high · CVSS 7.3 · Published 2026-10-05

A hospital management system used to track patient records and financial transactions contains an unauthenticated SQL injection vulnerability in its print receipt feature. An attacker can remotely extract sensitive patient data, transaction records, and plaintext credentials from the database without requiring a login.

Technologies: Onetwothreeneth HospitalManagementSystem. Vendors: Onetwothreeneth.

Quick answers

Is CVE-2026-105386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105386 being exploited in the wild.
How severe is CVE-2026-105386?: High severity, with a CVSS score of 7.3, published 5 October 2026.
Which products and versions are affected?: Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.
Is there a fix for CVE-2026-105386?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105386 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105386?: Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-based blind SQL injection (CWE-89) in print.php at lines 13–20, where the transaction_id GET parameter is interpolated directly into SQL queries without escaping or parameterized statements. The endpoint requires no authentication and allows extraction of the entire database through time-delay payloads. A fix exists but has not yet been released by the maintainers.

Affected products

onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d

Timeline

2026-09-16: disclosed: Issue reported on GitHub
2026-10-05: advisory: CVE-2026-105386 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.