Description
A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Published: 2026-07-17
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the login form of code‑projects Hospital Bed Management System 1.0, allowing an attacker to supply a crafted Username value that is inserted directly into an SQL query. This flaw permits arbitrary SQL commands to be executed against the database, enabling attackers to read sensitive data, modify records, or bypass authentication. The weakness is a classic SQL injection described by CWE‑74 and CWE‑89.

Affected Systems

The affected product is code‑projects Hospital Bed Management System version 1.0. No other versions are identified as vulnerable; the problem is confined to the login component of this release.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity, but the EPSS score of < 1 % suggests a low overall probability of exploitation. The vulnerability has been made public and is exploitable remotely via the web interface, so exposed deployments remain at risk. The issue is not listed in the CISA KEV catalog; however, publicly available exploit code reduces the barrier to targeted attacks.

Generated by OpenCVE AI on July 31, 2026 at 00:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an official update or patch to Hospital Bed Management System 1.0 that removes the SQL injection flaw.
  • Modify the login processing code to use prepared statements or parameterized queries for the Username field, and validate or sanitize input.
  • Restrict the database account used by the application to the minimum privileges required for normal operation, limiting potential damage if injection succeeds.

Generated by OpenCVE AI on July 31, 2026 at 00:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Title code-projects Hospital Bed Management System Login Form sql injection
First Time appeared Code-projects
Code-projects hospital Bed Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hospital_bed_management_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hospital Bed Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hospital Bed Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-21T01:36:31.542Z

Reserved: 2026-07-17T05:35:18.867Z

Link: CVE-2026-16014

cve-icon Vulnrichment

Updated: 2026-07-21T01:32:57.222Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:36:07Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')