CVE-2026-104637 | onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d php/controller.php img unrestricted upload

October 2, 2026 Yanac

A vulnerability categorized as critical has been discovered in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation of the argument img can lead to unrestricted upload.

The identification of this vulnerability is CVE-2026-104637. The attack may be launched remotely. Furthermore, there is an exploit available.

This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More