Hospital Management System Project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-40502 SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click fCritical 9.8 · Jul 22, 2024
• CVE-2024-28320 Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access High 7.6 · Apr 29, 2024
• CVE-2022-48120 SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers Critical 9.8 · Jan 20, 2023
• CVE-2022-46093 Hospital Management System v1.0 is vulnerable to SQL Injection.High 8.2 · Jan 13, 2023
• CVE-2022-38637 Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.Critical 9.8 · Sep 13, 2022
• CVE-2022-34590 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.High 7.2 · Jul 20, 2022
• CVE-2022-32095 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.Critical 9.8 · Jul 1, 2022
• CVE-2022-32094 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.Critical 9.8 · Jul 1, 2022
• CVE-2022-32093 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php.Critical 9.8 · Jul 1, 2022
• CVE-2022-30516 In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks.Critical 9.8 · May 26, 2022
• CVE-2022-30012 In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtaHigh 7.5 · May 16, 2022
• CVE-2022-30011 In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability.Critical 9.8 · May 16, 2022
• CVE-2022-28929 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the delid parameter at viewtreatmentrecord.php.Critical 9.8 · May 15, 2022
• CVE-2022-30449 Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in room.php.Critical 9.8 · May 11, 2022
• CVE-2022-30448 Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php.Critical 9.8 · May 11, 2022
• CVE-2022-27420 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.Critical 9.8 · May 3, 2022
• CVE-2022-27413 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php.Critical 9.8 · May 3, 2022
• CVE-2022-27299 Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php.Critical 9.8 · Apr 26, 2022
• CVE-2022-26546 Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin passwCritical 9.1 · Mar 31, 2022
• CVE-2022-24136 Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php.Critical 9.8 · Mar 31, 2022
• CVE-2022-25492 HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php.Critical 9.8 · Mar 15, 2022
• CVE-2022-25491 HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php.High 7.5 · Mar 15, 2022
• CVE-2022-25490 HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php.Critical 9.8 · Mar 15, 2022
• CVE-2022-25403 HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.Critical 9.8 · Feb 24, 2022
• CVE-2022-25402 An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.Critical 9.1 · Feb 24, 2022