CVE-2026-3046 is a high severity flaw (CVSS 7.3) in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. The profile_id argument in the profile check page reaches the database unsafely, allowing SQL injection. It can be attempted remotely, and the exploit is public.
What's affected
The NVD record lists version 1.0 of this application. The NVD record does not name a fixed version, so assume every copy you run is exposed until the maintainer says otherwise. The public disclosure and the record are the only sources for this issue.
How to check if you're exposed
Find out whether itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 runs anywhere in your environment, including test servers and old demos. Search your web roots for the file check_profile_old.php, which the record names.
Then check who can reach it. A copy that is open to the internet is the case that matters most, so review the web server, reverse proxy and firewall rules for that host.
What to do now
- Remove itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 from any internet-facing host, or restrict it to a trusted network or VPN.
- Check the project page and the maintainer's contact channels for a fix, and apply it if one has appeared since this was written.
- Treat any health or personal data stored in this application as at risk, and review who has had access.
- Back up and then audit the database for unexpected rows or accounts.
- If you maintain the code, use parameterised queries and check that profile_id is an integer.
- Keep a list of small third party applications like this one, so a new advisory can be matched against it quickly. The Gold page for this CVE has the latest data: https://gold.safeguard.sh/vulnerability/CVE-2026-3046
Why it matters
The record files this under CWE-74 and CWE-89. The input is placed into a database query without being neutralised, which is the textbook form of CWE-89. A request parameter that should hold a plain value is read as part of the query itself, so the attacker can change what the database does. Parameterised queries are the standard fix, and they are a change the maintainer or your own developers must make in the code.
The NVD description says the exploit is public, so anyone can read how the weakness works. A public write-up and no vendor fix is a poor mix for a system that holds real data, which is why exposure control is the main defence here. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Why does health data raise the stakes?
The application is described as a health monitoring logbook, so a database leak may include personal health information. Check your legal duties if you hold such data.
Is there a fix?
The record names none.
Sources
Last reviewed: 19 October 2026.
