A SQL injection vulnerability (CVE-2026-7632) was discovered in code-projects Online Hospital Management System version 1.0. The vulnerability affects the /viewappointment.php file through manipulation of the 'delid' parameter. The flaw allows remote attackers to perform SQL injection attacks. The exploit has been publicly disclosed and is available for use, making this a high-priority security concern for affected systems.