Vulnerability · Published Sep 7, 2026 · Assigned by VulDB

CVE-2026-86302code-projects Hospital Information System SQL Database Backup File his.sql information disclosure

Medium 5.3

In plain English

A medium-severity information exposure in Hospital Information System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 54.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Affected products (as reported)

Vendor	Product	Versions
code-projects	Hospital Information System	1.0

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-399466 | code-projects Hospital Information System SQL Database Backup File his.sql information disclosure vdb-entry
VDB-399466 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-86302 | CVE Analysis and Report third-party-advisory
Submit #906752 | code-projects Hospital Information System 1.0 Information Disclosure third-party-advisory
https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hospital%20Information%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md exploit
https://code-projects.org/ product