Description
A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of the argument secret with the input secret causes use of hard-coded cryptographic key . The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used.
Affected products
fabian: hospital management system
References6
- github.com/lakshayyverma/CVE-Discovery/blob/main/Hospital%20Man… ExploitMitigationThird Party Advisory
- github.com/lakshayyverma/CVE-Discovery/blob/main/Hospital%20Man… ExploitMitigationThird Party Advisory
- code-projects.org/ Product
- vuldb.com/?ctiid.327932 Permissions RequiredVDB Entry
- vuldb.com/?id.327932 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.672589 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
8.1
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
2.9
LOW
Score source: CNA
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 44 · as of 9 November 2026
- CWE
- CWE-320CWE-321
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.