# CVE-2026-111990: kishan0725 Hospital Management System SQL injection in appointment cancellation

Source: https://junglewise.ai/threats/cve-2026-111990-a-weakness-has-been-identified-in-kishan0725-hospital-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-111990 · Severity: high · CVSS 7.3 · Published 2026-10-18

Hospital Management System is a web application that handles patient and doctor appointment scheduling. An unauthenticated attacker can cancel any appointment or extract database contents by exploiting a SQL injection flaw in the appointment cancellation endpoint. This allows disruption of hospital operations and unauthorized access to sensitive patient and scheduling data.

Technologies: [Kishan0725 Hospital Management System](https://junglewise.ai/threats/technologies/kishan0725-hospital-management-system). Vendors: [Kishan0725](https://junglewise.ai/threats/vendors/kishan0725).

## Quick answers

**Is CVE-2026-111990 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111990 being exploited in the wild.

**How severe is CVE-2026-111990?** High severity, with a CVSS score of 7.3, published 18 October 2026.

**Which products and versions are affected?** Kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1.

**Is there a fix for CVE-2026-111990?** No fixed version is recorded yet. Use prepared statements with bound integer parameters for the ID parameter in both admin-panel.php and doctor-panel.php. Add explicit session and role-based authorization checks at the top of both files to ensure users can only cancel appointments belonging to themselves.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111990 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111990?** Check whether you run Kishan0725 Hospital Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use prepared statements with bound integer parameters for the ID parameter in both admin-panel.php and doctor-panel.php. Add explicit session and role-based authorization checks at the top of both files to ensure users can only cancel appointments belonging to themselves.</anigation>
</invoke>

## Technical details

The appointment cancellation handlers in admin-panel.php and doctor-panel.php concatenate the unsanitized GET parameter ID directly into UPDATE SQL statements executed via mysqli_query, allowing SQL injection. No authentication or authorization checks are performed before processing cancellation requests, enabling unauthenticated remote attackers to cancel arbitrary appointments or perform blind SQL injection to extract database content. The vulnerability enables both direct data manipulation (mass appointment cancellation) and information disclosure through time-based blind SQL injection.

## Affected products

- kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1

## Timeline

- 2026-09-29: disclosed
- 2026-10-18: advisory

## References

- [https://github.com/kishan0725/Hospital-Management-System/issues/75](https://github.com/kishan0725/Hospital-Management-System/issues/75)
- [https://vuldb.com/cve/CVE-2026-111990](https://vuldb.com/cve/CVE-2026-111990)

## Related threats

- [kishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in appsearch.php via the email parameter.](https://junglewise.ai/threats/cve-2025-63514-kishan0725-hospital-management-system-has-a-cross-site-scripting)
- [kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the…](https://junglewise.ai/threats/cve-2025-63513-kishan0725-hospital-management-system-v4-has-an-insecure-direct)
- [kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the…](https://junglewise.ai/threats/cve-2025-63512-kishan0725-hospital-management-system-v4-is-vulnerable-to-sql)