Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
113 results · page 3 of 3
Feb 24, 2022HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.CVE-2022-25403 · Other software · Hospital Management System Project · reported by MITRECritical 9.8
HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.CVE-2022-25402 · Other software · Hospital Management System Project · reported by MITRECritical 9.1
An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.CVE-2022-24226 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parametCVE-2022-24646 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parameters.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.CVE-2022-24263 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 16, 2021Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.CVE-2021-38757 · Other software · Hospital Management System Project · reported by MITREMedium 6.1
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 16, 2021Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.CVE-2021-38756 · Other software · Hospital Management System Project · reported by MITREMedium 6.1
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2021Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.CVE-2021-38755 · Other software · Hospital Management System Project · reported by MITREMedium 5.3
Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2021SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.CVE-2021-38754 · Other software · Hospital Management System Project · reported by MITRECritical 9.8
SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the NCVE-2020-36011 · Other software · Qdocs · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field.
- Product
- Smart Hospital
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 19, 2019SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/patientdetails.php.CVE-2018-17393 · Other software · Healthnode Hospital Management System Project · reported by MITRECritical 9.8
SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/patientdetails.php.
- Product
- Healthnode Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 29, 2018PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno CVE-2018-18705 · Websites & servers · Phptpoint · reported by MITRECritical 9.8
PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 27, 2017Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14846 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.