CVE-2026-6005

CVE-2026-6005 is a SQL injection vulnerability in code-projects Patient Record Management System version 1.0, specifically in the /hematology_print.php file where the hem_id parameter is improperly validated. This flaw allows authenticated attackers to manipulate the vulnerable parameter and inject malicious SQL commands into the application. The vulnerability carries a CVSS v3.1 score of 6.3 (medium severity) with a network-based attack vector requiring low complexity and valid user credentials. Successful exploitation could result in confidentiality, integrity, and availability impacts, though the scope remains unchanged as the impact is limited to the vulnerable component itself. While exploit code has been publicly disclosed, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00031 indicates this CVE presents a below-average likelihood of exploitation compared to other published vulnerabilities, and it remains on the inactive portion of vulnerability tracking lists.