CVE-2026-2057 is a high severity SQL injection flaw (CVSS 7.3) in the login page of SourceCodester Medical Center Portal Management System 1.0. The User argument in /login.php reaches a query unsafely and a public exploit exists. No fix is listed, so retire the app or correct the query.
What's affected
SourceCodester Medical Center Portal Management System 1.0 is affected, in /login.php through the User argument. The record lists no patched version. A flaw in a login form is especially serious because anyone who can reach the page can try it, with no account.
How to check if you're exposed
Check whether the affected file exists in your deployment:
find . -name login.php
If it does, review how the ID or user value reaches the SQL query in that file, and check your web server logs for unusual values in that parameter.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in. It will not find flaws in code you wrote, so pair it with a review of the query in the affected file.
What to do now
- Find out whether the application is deployed anywhere you manage.
- Take it off the public internet, or put it behind a login or VPN, if it is a demo or training system.
- Change the query to use prepared statements with bound parameters, and validate the value type.
- Run the database user with the least rights the application needs, and check logs for earlier abuse.
Why it matters
SQL injection, CWE-89, happens when a request value is placed into a database query as text instead of being passed as a parameter. The database cannot tell data from instructions, so crafted input can change what the query does. CWE-74 is the parent class, improper neutralization of special elements.
The fix pattern is the same everywhere: parameterized queries, input validation and a database account with the minimum rights. The CVE is not in CISA's KEV list.
Quick check
Is a vendor patch available?
The record lists none. Fix the code yourself or retire the software.
Is exploitation confirmed in the wild?
The record says an exploit is public. It does not report attacks, and the CVE is not in KEV.
Sources
Last reviewed: 19 October 2026.
