CVE-2026-2706
Published: 19 February 2026
Summary
CVE-2026-2706 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Patient Record Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2706 is a SQL injection vulnerability (CWE-74, CWE-89) in code-projects Patient Record Management System 1.0. The flaw resides in an unknown function within the file /fecalysis_not.php, where manipulation of the comp_id argument triggers the injection. Published on 2026-02-19, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation by authenticated attackers possessing low privileges. Successful attacks can result in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL queries.
Advisories and further details are available through VulDB entries at https://vuldb.com/?ctiid.346652, https://vuldb.com/?id.346652, and https://vuldb.com/?submit.754407, as well as the software site at https://code-projects.org/. An exploit has been published on GitHub at https://github.com/1768161086/sql_cve and may be used.
Notable context includes the public availability of the exploit, increasing the risk of active exploitation against unpatched instances of the affected system.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7562
Vulnerability details
A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the file /fecalysis_not.php. This manipulation of the argument comp_id causes sql injection. The attack can be initiated remotely. The exploit has been…
more
published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in remotely accessible web app (/fecalysis_not.php) directly enables exploitation of a web application for limited data access/modification/disruption.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of inputs such as the comp_id parameter to block SQL injection payloads before they reach the database.
Mandates timely remediation of the published SQL injection flaw in /fecalysis_not.php before exploitation occurs.
Restricts the low-privilege authenticated accounts that the published exploit requires, limiting the scope of any successful injection.