VYPR
Vypr IntelligenceAI-generatedSep 4, 2026· 6 CVEs

Code Projects: Six SQLi Flaws in Doctor Appointment and Hospital Systems Disclosed Together

Six high-severity SQL injection flaws disclosed together for Code Projects' Doctor Appointment System and Hospital Information System, with public exploits available.

Key findings

  • Six high-severity SQL injection vulnerabilities disclosed together for Code Projects applications.
  • All vulnerabilities affect version 1.0 of the Doctor Appointment System and Hospital Information System.
  • Exploits for all six CVEs are publicly available, increasing immediate risk.
  • All identified flaws have been patched by the vendor.
  • Vulnerabilities impact various files including contactus.php, booking.php, patient_login.php, PrespController.php, viewReq.php, and addReq.php.
  • All CVEs share a CVSSv3 score of 7.3 and allow for remote exploitation.

On September 4, 2026, a batch of six high-severity SQL injection vulnerabilities was disclosed across two Code Projects applications: the Doctor Appointment System and the Hospital Information System. These vulnerabilities, with CVSSv3 scores of 7.3, were disclosed within a five-hour window, indicating a coordinated disclosure event. The widespread nature of these SQL injection flaws across different components and files within these systems poses a significant risk to organizations using this software.

The vulnerabilities identified in the Doctor Appointment System (versions 1.0) include CVE-2026-85403, affecting the /contactus.php file via manipulation of the firstname argument; CVE-2026-85402, impacting the /patient/booking.php file through the doc_id argument; and CVE-2026-85225, found in /patient_login.php via the email argument. All three allow for remote exploitation.

Similarly, the Hospital Information System (versions 1.0) is affected by three SQL injection flaws: CVE-2026-85399, targeting the getSinglePresp function in includes/presp/PrespController.php via the ID argument; CVE-2026-85398, affecting the viewReq function in viewReq.php through the ID argument; and CVE-2026-85397, impacting the findBySearch function in addReq.php via the Search argument. These also permit remote attacks.

A critical aspect of this disclosure is that for every identified vulnerability, the exploit has been publicly published and may be actively used. This significantly increases the immediate risk to any organization running unpatched versions of these systems. The attackers can leverage readily available exploit code to compromise these applications remotely.

All six vulnerabilities were patched in a single release, though specific version numbers for the fix were not provided in the disclosure details. Users of the Code Projects Doctor Appointment System and Hospital Information System are strongly advised to update to the latest available versions immediately to mitigate the risk of these SQL injection attacks. The coordinated disclosure and public availability of exploits underscore the urgency for prompt patching.

This batch of vulnerabilities highlights a recurring pattern of SQL injection flaws in Code Projects' applications, particularly in versions 1.0 of both the Doctor Appointment System and the Hospital Information System. The simultaneous disclosure and the public availability of exploits for all six CVEs necessitate immediate attention from system administrators. Organizations should prioritize updating their systems to the latest versions to protect against potential remote exploitation.

The affected systems are:

  • Doctor Appointment System 1.0
  • Hospital Information System 1.0

The vulnerabilities include:

All vulnerabilities are rated High with a CVSSv3 score of 7.3 and allow for remote exploitation. Exploits for all CVEs are publicly available.

The vendor has released patches for all identified vulnerabilities. Users are urged to update their systems immediately.

The coordinated disclosure of these six SQL injection vulnerabilities across two Code Projects applications within a short timeframe, coupled with the public availability of exploits, presents a significant and immediate threat. Administrators of the Doctor Appointment System and Hospital Information System must prioritize applying available patches to prevent remote exploitation.

Key findings:

  • Six high-severity SQL injection vulnerabilities disclosed together for Code Projects applications.
  • All vulnerabilities affect version 1.0 of the Doctor Appointment System and Hospital Information System.
  • Exploits for all six CVEs are publicly available, increasing immediate risk.
  • All identified flaws have been patched by the vendor.
  • Vulnerabilities impact various files including contactus.php, booking.php, patient_login.php, PrespController.php, viewReq.php, and addReq.php.
  • All CVEs share a CVSSv3 score of 7.3 and allow for remote exploitation.
AI-written article. Grounded in 6 CVE records listed below.