CVE-2026-6006 is a SQL injection vulnerability affecting code-projects Patient Record Management System version 1.0, specifically in the /edit_hpatient.php file where the ID parameter is inadequately sanitized. This flaw allows attackers to execute arbitrary SQL queries against the underlying database. The vulnerability carries a CVSS score of 6.3 (Medium) with a network-based attack vector requiring low complexity and authenticated access, resulting in potential confidentiality, integrity, and availability impacts. While the exploit has been publicly disclosed and proof-of-concept code may be available, the vulnerability is currently not listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community activity based on its inactive hot list status. Organizations running this patient management system should prioritize patching or implementing access controls to restrict the affected functionality, given the sensitive nature of patient data at risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Code-Projects | Patient Record Management System | 1.0CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.