Cyber Resilience

CVE-2026-7632

Medium

Published: 02 May 2026

Published
02 May 2026
Modified
05 May 2026
KEV Added
Patch
CVSS Score v4 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0005 15.2th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7632 is a medium-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-7632 is a SQL injection vulnerability (CWE-74, CWE-89) in the code-projects Online Hospital Management System version 1.0. The issue affects an unknown function within the file /viewappointment.php, where manipulation of the 'delid' argument enables injection. Published on 2026-05-02 with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), it allows remote exploitation.

Remote attackers require no privileges or user interaction to exploit the vulnerability. Successful attacks can result in low-level impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL payloads. The exploit has been publicly disclosed and may be utilized by threat actors.

Advisories and related details are available through references including the vendor site at https://code-projects.org/, GitHub repositories at https://github.com/Sh1tKing/cve/blob/main/CVE-2026-7632.md and https://github.com/Sh1tKing/cve/blob/main/time-blind-sql.md detailing the exploit, and VulDB entries at https://vuldb.com/submit/806633 and https://vuldb.com/vuln/360578. No specific patches or mitigations are detailed in the provided information.

The public disclosure of the exploit increases the risk of real-world exploitation against unpatched instances of the affected software.

EU & UK References

Vulnerability details

A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit…

more

has been publicly disclosed and may be utilized.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection vulnerability in a public-facing web application (/viewappointment.php) allows remote unauthenticated exploitation for data access/modification, directly mapping to T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3150Shared CWE-74, CWE-89
CVE-2026-3746Shared CWE-74, CWE-89
CVE-2025-2683Shared CWE-74, CWE-89
CVE-2026-5238Shared CWE-74, CWE-89
CVE-2026-4288Shared CWE-74, CWE-89
CVE-2026-2220Shared CWE-74, CWE-89
CVE-2025-1535Shared CWE-74, CWE-89
CVE-2026-0597Shared CWE-74, CWE-89
CVE-2026-1688Shared CWE-74, CWE-89
CVE-2026-5018Shared CWE-74, CWE-89

Affected Assets

Code Projects
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents SQL injection by requiring validation and sanitization of the 'delid' parameter in /viewappointment.php before database queries.

prevent

Mandates timely remediation of the specific SQL injection flaw in the Online Hospital Management System 1.0.

detect

Enables proactive detection of the SQL injection vulnerability through regular vulnerability scanning of the affected application.

References