A vulnerability in the registration handler of code-projects Online Hospital Management System 1.0 allows an attacker to manipulate the Username argument and bypass normal authorization checks. By crafting a registration request with a malicious username, an unauthenticated user can create or modify accounts without proper privilege verification, potentially gaining access to protected patient data. This flaw is categorized as improper authorization (CWE‑266) and improper input validation (CWE‑285).

The affected product is code-projects Online Hospital Management System, version 1.0. The fault resides in the registration handler component and affects an unknown function that processes user registrations.

The CVSS score of 5.3 indicates moderate severity, while no EPSS score is available suggesting limited current exploitation data. It is inferred from the description that the attack can be performed remotely via the registration endpoint; the public availability of an exploit and the impact on confidential patient data give this vulnerability a moderate risk posture. Although it is not listed in the CISA KEV catalog, the existence of a publicly available exploit warrants timely remediation.