The vulnerability in code‑projects Online Hospital Management System lies in the viewdoctortimings.php script, where an attacker can craft the delid argument to reach resources that should be protected. This flaw is a classic Insecure Direct Object Reference (CWE‑99). If exploited, the attacker could retrieve or manipulate doctor schedule data and potentially other sensitive information that the application should guard.

The issue is present in code‑projects Online Hospital Management System version 1.0. No other affected releases are documented, and the description notes that the weakness involves unknown processing of viewdoctortimings.php. The vulnerability only references that specific endpoint.

The CVSS score of 5.1 indicates moderate risk. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. An exploit has been published publicly, suggesting that attackers can obtain and use it with relative ease. The attack vector is remote; an attacker can send HTTP requests that modify the delid parameter. Based on the description, it is inferred that authentication may not be required for the exploit to succeed, but this is not explicitly stated in the input.