CVE-2026-7632
Published: 02 May 2026
Summary
CVE-2026-7632 is a medium-severity Injection (CWE-74) vulnerability in Code Projects (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-7632 is a SQL injection vulnerability (CWE-74, CWE-89) in the code-projects Online Hospital Management System version 1.0. The issue affects an unknown function within the file /viewappointment.php, where manipulation of the 'delid' argument enables injection. Published on 2026-05-02 with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), it allows remote exploitation.
Remote attackers require no privileges or user interaction to exploit the vulnerability. Successful attacks can result in low-level impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL payloads. The exploit has been publicly disclosed and may be utilized by threat actors.
Advisories and related details are available through references including the vendor site at https://code-projects.org/, GitHub repositories at https://github.com/Sh1tKing/cve/blob/main/CVE-2026-7632.md and https://github.com/Sh1tKing/cve/blob/main/time-blind-sql.md detailing the exploit, and VulDB entries at https://vuldb.com/submit/806633 and https://vuldb.com/vuln/360578. No specific patches or mitigations are detailed in the provided information.
The public disclosure of the exploit increases the risk of real-world exploitation against unpatched instances of the affected software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26794
Vulnerability details
A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit…
more
has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in a public-facing web application (/viewappointment.php) allows remote unauthenticated exploitation for data access/modification, directly mapping to T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the 'delid' parameter in /viewappointment.php before database queries.
Mandates timely remediation of the specific SQL injection flaw in the Online Hospital Management System 1.0.
Enables proactive detection of the SQL injection vulnerability through regular vulnerability scanning of the affected application.