A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital…
Priority HIGH 82CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01181 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | PHPGurukul |
- cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·PHPGurukul
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26629
- 2026-10-03 Alias added: GHSA-qh26-cpr6-mhm2
References
More PHPGurukul Hospital Management System vulnerabilities
- TI-2024-34337 An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
- TI-2023-15100 A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0… CVSS 3.1CRITICAL 9.8
- TI-2024-00330 PHPGurukul Hospital Management System patient-search.php sql injection CVSS 3.1CRITICAL 9.8
- TI-2024-00329 PHPGurukul Hospital Management System change-password.php sql injection CVSS 3.1CRITICAL 9.8
- TI-2024-00327 PHPGurukul Hospital Management System edit-doctor-specialization.php sql injection CVSS 3.1CRITICAL 9.8
- TI-2025-43014 PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. CVSS 3.1HIGH 8.8
Sources
- CVE-2020-26629 · CVE Program
- CVE-2020-26629 · NVD
- FIRST EPSS
- GHSA-qh26-cpr6-mhm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences