CVE-2026-10184: SQL Injection in Hospitals Patient Records Management System

The National Vulnerability Database (NVD) has detailed CVE-2026-10184, a high-severity SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System version 1.0. This flaw, rated 7.3 CVSS, affects an unspecified function within the /classes/Users.php?f=delete file. Attackers can manipulate the ID argument to trigger the SQL injection.

This is a critical flaw because the exploit has been publicly released, making it accessible to a wide range of threat actors. Remote exploitation is possible, meaning attackers don’t need direct network access to the target system. Given the sensitive nature of patient records, a successful exploit could lead to unauthorized access, modification, or deletion of highly confidential data, directly impacting patient privacy and potentially compromising healthcare operations.

Organizations using this specific patient records management system are at immediate risk. The public availability of the exploit drastically reduces the attacker’s effort, shifting the calculus from complex zero-day research to simple exploit execution. Defenders must assume this vulnerability is actively being scanned for and exploited.