CVE-2024-23747

CVE-2024-23747 Moderna Sistemas ModernaNet 医院管理系统 2024 存在不安全的直接对象引用 IDOR 漏洞。 PoC 该漏洞存在于系统通过 /Modernanet/LAUDO/LAU0000100/Laudo?id= URL 处理用户数据访问的过程中。通过操纵此 id 参数，攻击者能够获取敏感的医疗信息。 http://IP/Modernanet/LAUDO/LAU0000100/Laudo?id=NUMBER 你无需登录即可查看结果。 额外信息 由于该 IDOR 可获取到弱凭证，因此有可能利用这些凭证访问该医院的用户账户。 参考...

CVE-2022-27413

Hospital-Management-System v1.0 - SQL 注入 厂商 描述： 存在漏洞的页面是 admin.php http://you ip/HMS/admin.php Hospital-Management-System v1.0 admin.php 页面中的 adminname 参数似乎容易受到 SQL 注入攻击。 +sqlmap: python3 sqlmap.py -r Your post packet.txt --random-agent --risk=3 --level=3 -dbs + Payloads: root@kitploit: Parameter...

Hospital Management System 4.0 - SQL Injection

Hospital Management System 4.0 contains multiple SQL injection vulnerabilities because multiple pages and parameters do not validate user input. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of...

PHPGurukul Hospital Management System - Cross-Site Scripting

PHPGurukul Hospital Management System in PHP 4.0 contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2020-5191 info: name: PHPGurukul Hospital Management System -...

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/doctor.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/admin.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

PHPGurukul Hospital Management System 4.0 - SQL Injection

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information. id: CVE-2020-22165 info: name: PHPGurukul Hospital Management System 4.0 - SQL Injection...

Hospital Management System 1.0 - Cross-Site Scripting

Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php and patient-search.php. id: CVE-2021-39411 info: name: Hospital Management System 1.0 - Cross-Site Scripting author: arafatansari severity: high description: | Hospital...

Zero-Day-Legacy

🎓 卒業プロジェクト — Ajloun National University ANU IT学部 · サイバーセキュリティ＆クラウドコンピューティング · 2026年度 🏆 大学最高評価：97% 📖 概要 Zero-Day Legacy は、Ajloun National University の卒業プロジェクトとして構築された、現実的で意図的に脆弱性を持たせた Boot-to-Root CTF（Capture The Flag） ラボマシンです。複数の脆弱性クラスにわたる完全な実世界の攻撃チェーンを包含する、Royal Health Hospital という病院管理システ...

CVE-2023-7173

CVE-2023-7173：医院管理系统中的存储型跨站脚本（XSS）漏洞 漏洞详情 CVE ID： CVE-2023-7173 漏洞类型： 存储型 XSS 受影响组件： 用户登录页面 易受攻击的参数： Fullname 供应商详情： phpgurukul.com 受影响版本： 医院管理系统 1.0 漏洞描述 存储型跨站脚本（XSS）是一种严重的 Web 漏洞，允许将恶意代码注入网站，存储在数据库中，并在其他用户查看受感染页面时执行。在本案例中，该漏洞存在于医院管理系统（HMS）的用户登录页面中，其中“Fullname”参数容易受到存储型 XSS...

CVE-2023-7172

CVE-2023-7172 概述 本项目包含一个存在漏洞的医院管理系统（HMS）版本，该系统容易受到 SQL 注入（CVE-2023-7172）攻击。SQL 注入是一种严重的 Web 应用程序漏洞，可能对系统的安全性和功能造成严重影响。 CVE 详情 CVE ID： CVE-2023-7172 漏洞类型： SQL 注入 受影响组件： 管理员登录页面 易受攻击的参数： username 供应商详情： phpgurukul.com 受影响版本： 医院管理系统 1.0 复现步骤（PoC） 克隆仓库： root@kitploit: git clone...

CVE-2026-82914

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-82914

kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...

EUVD-2026-68807

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

EUVD-2026-64647

A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be use...

CVE-2026-78112

A SQL injection vulnerability exists in itsourcecode Hospital Management System Project in PHP 1.0 , specifically in the file /viewservicetype.php through manipulation of the delid parameter. The flaw can be exploited remotely and requires low privileges (authenticated access). CVSS 3.1 scores it...

PT-2026-79765

A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be use...

EUVD-2026-63485

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...

CVE-2026-77025

itsourcecode Hospital Management System 1.0 is affected by a SQL injection vulnerability in the file /viewappointmentpending.php , triggered by manipulation of the delid parameter. The attack can be carried out remotely with low privileges and no user interaction. A proof-of-concept exploit has b...

CVE-2026-76991

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation of the argument delid results in sql injection. Remote exploitation of the attack is possible. The exploit has been made publi...