CVE-2026-6602 MEDIUM

CVE-2026-6602: rickxy Hospital Management System his_admin_account.php unrestricted upload

Vendor Rickxy
Product Hospital Management System
Weakness CWE-434 · Unrestricted file upload
Published April 20, 2026
Last update April 20, 2026

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /backend/admin/his_admin_account.php. The manipulation of the argument ad_dpic results in unrestricted upload. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.

Key dates

Disclosure timeline

April 20, 2026 CVE published
April 20, 2026 Record updated