{"id":"CVE-2022-22296","aliases":["EUVD-2022-27442","GHSA-pg55-hv8r-frmh"],"status":"published","title":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure...","description":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00989,"percentile":0.62754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-276"],"published":"2022-01-24T13:11:53Z","modified":"2026-06-17T04:28:11Z","exploits":[{"source":"pocgithub","id":"vlakhani28/CVE-2022-22296","title":"vlakhani28/CVE-2022-22296","date":"2022-01-21","url":"https://github.com/vlakhani28/CVE-2022-22296"}],"products":[{"vendor":"hospital\\'s_patient_records_management_system_project","product":"hospital\\'s_patient_records_management_system"}],"references":[{"url":"https://github.com/vlakhani28/CVE-2022-22296/blob/main/README.md","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22296"},{"url":"https://github.com/advisories/GHSA-pg55-hv8r-frmh"}],"sources":{"cve":[{"id":"CVE-2022-22296","description":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed.","status":"published","published":"2022-01-24T13:11:53Z","modified":"2024-08-03T03:07:50.396Z","updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-27442","description":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed.","status":"published","published":"2022-01-24T13:11:53Z","modified":"2024-08-03T03:07:50Z","updated_at":"2026-11-03T03:25:52.788605Z"}],"ghsa":[{"id":"GHSA-pg55-hv8r-frmh","title":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure...","description":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed.","status":"published","published":"2022-01-25T00:01:12Z","modified":"2023-02-03T05:05:18Z","cwes":["CWE-276"],"updated_at":"2026-11-02T14:53:42.900002Z"}],"nvd":[{"id":"CVE-2022-22296","description":"Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed.","status":"published","published":"2022-01-24T14:15:07.737Z","modified":"2026-06-17T04:28:11.667Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:07:11.52734Z"}]}}