An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.

Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it.

A SQL injection vulnerability exists in ProjectWorlds Hospital Management System in php 1.0 on login page that allows a remote attacker to compromise Application SQL database.

Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.

Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.

Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.

SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.