CVE-2026-86302 Details
Description
A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
A sensitive information disclosure vulnerability has been identified in Code-Projects Hospital Information System version 1.0. The issue arises from an SQL database backup file, 'his.sql', being exposed in a publicly accessible directory without proper access controls. This vulnerability allows unauthorized users to retrieve the file via HTTP, potentially disclosing sensitive application data such as database schema, user records, and other confidential information stored by the application.
To address this vulnerability, sensitive database files should be removed from public application directories and stored outside the web server's document root. Web server configurations should be updated to deny access to file types such as '.sql', '.bak', and '.backup'. For Apache, this can be done using a 'FilesMatch' directive, and for Nginx, by denying access in the location block. Additionally, developers should ensure that release packages do not include sensitive files or artifacts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Not ApplicableVendor |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hospital%20Information%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-86302 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/906752 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399466 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399466/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code-projects Hospital Information System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |