Security Digest: May 31, 2026 - 8 Critical Vulnerabilities

Eight high-severity vulnerabilities disclosed today expose authentication bypass, SQL injection, and potential database compromise across open-source and healthcare/admin software. Several issues have public exploit code, which raises the risk of rapid weaponization.

· 8 min read

Executive Summary

Eight high-severity vulnerabilities disclosed today expose authentication bypass, SQL injection, and potential database compromise across open-source and healthcare/admin software. Several issues have public exploit code, which raises the risk of rapid weaponization. Teams should patch or isolate affected systems immediately, especially internet-facing apps and anything handling credentials, patient records, or HR data.

Act now: prioritize exposed services, revoke risky sessions, and verify whether any of these applications are reachable from untrusted networks.

Critical Vulnerabilities

CVE-2026-49489: OpenCATS DataGrid SQL injection via sortDirection

  • Impact: Authenticated attackers can extract database contents using blind SQL injection, including sensitive HR and candidate data.
  • Affected Systems: OpenCATS through 0.9.7.4
  • Immediate Action: Restrict access to the application, review all authenticated user activity, and disable external access until patched.
  • Mitigation: Apply the vendor fix as soon as available; if no patch is posted, place the app behind VPN or IP allowlisting and monitor for abnormal ajax/getDataGridPager.php requests.

CVE-2026-49490: OpenCATS filter bypass enables SQL injection in Candidates DataGrid

  • Impact: Authenticated attackers can bypass filter restrictions and run arbitrary SQL queries against the database.
  • Affected Systems: OpenCATS from 0.9.1a
  • Immediate Action: Treat this as a data-exposure risk now; review database logs and limit user access to the Candidates DataGrid.
  • Mitigation: Patch immediately when available; as a temporary control, disable or restrict the vulnerable grid/filter functionality and enforce least-privilege database credentials.

CVE-2026-10178: Online Music Site AdminEditAlbum SQL injection

  • Impact: Remote attackers can inject SQL through the ID parameter and may read or alter backend data; public exploit code is available.
  • Affected Systems: code-projects Online Music Site 1.0
  • Immediate Action: Take the admin panel offline or restrict it to trusted IPs until fixed.
  • Mitigation: Upgrade to a patched release if available; otherwise remove public exposure and inspect for suspicious requests to /Administrator/PHP/AdminEditAlbum.php.

CVE-2026-10157: Open5GS NGAP PathSwitchRequest improper authentication

  • Impact: Remote attackers may bypass authentication controls in the NGAP PathSwitchRequest handler, potentially disrupting mobile core trust boundaries.
  • Affected Systems: Open5GS up to 2.7.6
  • Immediate Action: Patch immediately and review any exposed AMF interfaces for unauthorized signaling traffic.
  • Mitigation: Apply commit a188e36b1741ffc2252133f59b1bda4f14d3cb5c or vendor update; if patching is delayed, isolate the AMF from untrusted networks.

CVE-2026-10167: School Student Management System role-based auth bypass

  • Impact: Remote attackers may manipulate the role parameter to gain improper authentication and access restricted functions.
  • Affected Systems: OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6
  • Immediate Action: Disable public access, force credential resets for privileged users, and inspect login flows for abuse.
  • Mitigation: No fixed version is listed; apply any upstream fix when released and temporarily restrict access through network controls.

CVE-2026-10184: Hospitals Patient Records Management System delete endpoint SQL injection

  • Impact: Remote attackers can inject SQL through the delete action, risking patient record exposure or modification; public exploit code exists.
  • Affected Systems: SourceCodester Hospitals Patient Records Management System 1.0
  • Immediate Action: Remove internet exposure and review all delete/user-management activity immediately.
  • Mitigation: Patch the application, rotate database credentials, and block access to /classes/Users.php?f=delete until verified safe.

CVE-2026-10185: Hospitals Patient Records Management System save endpoint SQL injection

  • Impact: Remote attackers can inject SQL through the save action, enabling unauthorized data access or tampering.
  • Affected Systems: SourceCodester Hospitals Patient Records Management System 1.0
  • Immediate Action: Suspend exposed save workflows and review recent admin actions for anomalies.
  • Mitigation: Apply the vendor fix if available; otherwise restrict access to /classes/Users.php?f=save, enforce WAF rules, and monitor database error logs.

CVE-2026-10186: Online Hospital Management System patient edit SQL injection

  • Impact: Remote attackers can inject SQL via editid, potentially exposing or altering patient records; exploit is public.
  • Affected Systems: code-projects Online Hospital Management System 1.0
  • Immediate Action: Restrict or disable /patient.php until patched and verify no unauthorized database changes occurred.
  • Mitigation: Patch immediately, apply WAF protections, and use least-privilege database accounts to limit blast radius.

Previously Alerted

What to Do Now

  1. Patch or isolate all affected applications today, starting with internet-facing systems and anything handling sensitive records.
  2. Restrict access with VPN, IP allowlisting, or temporary shutdown if no fix is available.
  3. Rotate credentials for application and database accounts if any of these systems were exposed publicly.
  4. Review logs for SQL errors, unusual parameter values, repeated admin requests, and unexpected authentication success.

Verification steps: confirm installed versions, check whether vulnerable endpoints are reachable, and validate that patches actually removed the affected code paths. If exploit code is public, assume scanning is already underway.

Monitoring recommendations: alert on spikes in 500 errors, time-based SQL patterns, repeated requests to admin or patient-management endpoints, and any new database accounts or privilege changes.

Related Resources

  • Internal blog post on rapid exposure triage for public-exploit CVEs (coming soon)
  • Internal blog post on WAF and access-control containment for SQL injection (coming soon)
  • Official vendor advisories for OpenCATS, Open5GS, and the affected SourceCodester/code-projects applications

Keep reading