Vendor
The Hospital-Management-System version 1.0 is vulnerable to remote SQL injection via the Contact parameter in /search.php, enabling potential unauthorized data access.