Is CVE-2026-85399 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85399 being exploited in the wild.

How severe is CVE-2026-85399?

High severity, with a CVSS score of 7.3, published 4 September 2026.

Which products and versions are affected?

Code-Projects Hospital Information System 1.0.

Is there a fix for CVE-2026-85399?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85399 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85399?

Check whether you run Code-Projects Hospital Information System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85399: code-projects Hospital Information System SQL injection

CVE-2026-85399 · Severity: high · CVSS 7.3 · Published 2026-09-04

Hospital Information System is a PHP-based web application for managing hospital operations and patient data. An SQL injection vulnerability in the patient prescription controller allows unauthenticated attackers to inject malicious SQL queries via the ID parameter, enabling unauthorized database access, data theft, modification, or deletion, and potential complete system compromise.

Technologies: Code-Projects Hospital Information System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-85399 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85399 being exploited in the wild.
How severe is CVE-2026-85399?: High severity, with a CVSS score of 7.3, published 4 September 2026.
Which products and versions are affected?: Code-Projects Hospital Information System 1.0.
Is there a fix for CVE-2026-85399?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85399 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85399?: Check whether you run Code-Projects Hospital Information System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the PrespController.php file of Hospital Information System 1.0, specifically in the getSinglePresp function. The vulnerable 'id' parameter is inserted directly into SQL queries without proper input validation or parameterized query protection. An attacker can supply crafted SQL payloads (boolean-based blind, error-based, time-based blind, or UNION-based SQL injection) to extract, modify, or delete database records. No authentication is required to exploit this vulnerability, and the attack vector is remote via HTTP GET or POST parameters. Prepared statements and input validation are required to remediate the issue.

Affected products

code-projects Hospital Information System 1.0

Timeline

2026-07-18: disclosed: Vulnerability reported on GitHub
2026-09-04: advisory: CVE-2026-85399 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.