Sql injection

HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php...

Cross site scripting

HMS v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via treatmentrecord.php...

CVE-2022-25490

HMS v1.0 contains a SQL injection flaw in the department.php editid parameter. The vulnerability is documented with CVSS v3.1 base score 9.8 (CRITICAL) and CVSS v2.0 base score 7.5 (HIGH), indicating network access, no authentication required, and potential high impact on confidentiality, integri...

CVE-2022-25490

HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php...

CVE-2022-25491

CVE-2022-25491 affects HMS v1.0. A SQL injection vulnerability exists in the editid parameter of appointment.php. Root cause: unsafely handled input enabling arbitrary SQL execution. Exploitation details are not provided in the connected documents. CVSS‑3.1 base score 7.5 (HIGH) with Network atta...

CVE-2022-25491

HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php...

CVE-2022-25492

HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php...

CVE-2022-25492

CVE-2022-25492 (HMS v1.0) has a SQL injection flaw in the ajaxmedicine.php medicineid parameter. The vulnerability is documented with high/severe impact: CVSS 3.1 base score 9.8 (NETWORK, LOW attack complexity, NO privileges, UI=NONE, S=UNCHANGED; confidentiality, integrity, and availability impa...

CVE-2022-25493

CVE-2022-25493 affects HMS v1.0 with a reflected cross-site scripting (XSS) vulnerability exposed via the parameter or path in treatmentrecord.php. The issue is documented across multiple feeds (NVD, Red Hat CVE, CNVD, CVE listing) as a reflected XSS vulnerability; exploitation status is not prov...

CVE-2022-25493

HMS v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via treatmentrecord.php...

HMS SQL Injection Vulnerability (CNVD-2022-71116)

HMS is a computer or web-based hospital management system in Bangladesh. Useful for managing the operations of a hospital or any medical facility, a SQL injection vulnerability exists in HMS v1.0, which stems from the fact that the product admin.php page does not do effective filtering of special...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25402

An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25402

An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

Improper access control

An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files...

Sql injection

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25403

HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php...

CVE-2022-25403

CVE-2022-25403 affects HMS v1.0, with a SQL injection vulnerability in the admin.php component. The issue stems from inadequate handling/validation of user input in admin.php, allowing injection of arbitrary SQL statements. Reported impact in CVSS indicates high severity with partial confidential...