355 matches found
CVE-2022-25491
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php...
CVE-2022-25491
CVE-2022-25491 affects HMS v1.0. A SQL injection vulnerability exists in the editid parameter of appointment.php. Root cause: unsafely handled input enabling arbitrary SQL execution. Exploitation details are not provided in the connected documents. CVSS‑3.1 base score 7.5 (HIGH) with Network atta...
CVE-2022-25491
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php...
CVE-2022-25492
CVE-2022-25492 (HMS v1.0) has a SQL injection flaw in the ajaxmedicine.php medicineid parameter. The vulnerability is documented with high/severe impact: CVSS 3.1 base score 9.8 (NETWORK, LOW attack complexity, NO privileges, UI=NONE, S=UNCHANGED; confidentiality, integrity, and availability impa...
CVE-2022-25492
HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php...
CVE-2022-25493
CVE-2022-25493 affects HMS v1.0 with a reflected cross-site scripting (XSS) vulnerability exposed via the parameter or path in treatmentrecord.php. The issue is documented across multiple feeds (NVD, Red Hat CVE, CNVD, CVE listing) as a reflected XSS vulnerability; exploitation status is not prov...
CVE-2022-25493
HMS v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via treatmentrecord.php...
CVE-2022-25493
HMS v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via treatmentrecord.php...
CVE-2022-25493: Improper Neutralization of Input During Web Page Generation
HMS v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via treatmentrecord.php...
CVE-2022-25490: Improper Neutralization of Special Elements used in an SQL Command
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php...
PT-2022-17327
Name of the Vulnerable Software and Affected Versions HMS version 1.0 Description A SQL injection issue was discovered in HMS via the editid parameter in the appointment.php file. This allows for potential exploitation. No information is provided about the estimated number of potentially affected...
PT-2022-17326
Name of the Vulnerable Software and Affected Versions HMS version 1.0 Description A SQL injection issue was found in HMS via the editid parameter in the "department.php" endpoint. This allows for potential exploitation. No information is provided about the estimated number of affected devices or...
CVE-2022-25491: Improper Neutralization of Special Elements used in an SQL Command
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php...
CVE-2022-25492: Improper Neutralization of Special Elements used in an SQL Command
HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php...
PT-2022-17329
Name of the Vulnerable Software and Affected Versions HMS version 1.0 Description A reflected cross-site scripting XSS issue was found in HMS via the treatmentrecord.php file. This allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized access or data...
PT-2022-17328
Name of the Vulnerable Software and Affected Versions HMS version 1.0 Description A SQL injection issue was found in HMS via the medicineid parameter in the "ajaxmedicine.php" endpoint. This allows for potential exploitation. Recommendations For HMS version 1.0, consider restricting access to the...
HMS SQL Injection Vulnerability (CNVD-2022-71116)
HMS is a computer or web-based hospital management system in Bangladesh. Useful for managing the operations of a hospital or any medical facility, a SQL injection vulnerability exists in HMS v1.0, which stems from the fact that the product admin.php page does not do effective filtering of special...
CVE-2022-25402
An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files...
