CVE-2026-104609

Name of the Vulnerable Software and Affected Versions onetwothreeneth HospitalManagementSystem versions up to 9ef91ed6007314b6473110ed699dff76d158f61d

Description A SQL injection flaw exists in the get() function within the edit accounts.php file. This issue occurs when the user id, patient id, physician id, discounts id, or services id arguments are manipulated, allowing for remote exploitation.

Recommendations As a temporary workaround, restrict access to the get() function in the edit accounts.php file or avoid using the user id, patient id, physician id, discounts id, and services id parameters until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.