Description
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /patientappointment.php. Such manipulation of the argument patiente leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unescaped input injection in the patientappointment.php file that allows attackers to supply a specially crafted value for the patiente parameter. Because the application concatenates this value directly into SQL statements, an attacker can inject arbitrary SQL code, potentially compromising the confidentiality, integrity, or availability of the underlying database. The weakness is classified as CWE-74 and CWE-89.

Affected Systems

Itsourcecode Hospital Management System version 1.0. The flaw resides in the patientappointment.php file.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity. An EPSS score of < 1% is available, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is remote: an attacker only needs to send a crafted HTTP request containing the patiente parameter to the vulnerable endpoint. The description confirms that the flaw allows arbitrary SQL execution, thus exposing the database to potential data loss or compromise. The overall risk for a system running this version is moderate to high.

Generated by OpenCVE AI on July 24, 2026 at 09:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor-released patch or newer version once available.
  • Modify the application to use prepared statements or parameterized queries for the patiente parameter.
  • Ensure that only authenticated and authorized users can access patientappointment.php, enforcing appropriate access controls.

Generated by OpenCVE AI on July 24, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /patientappointment.php. Such manipulation of the argument patiente leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Hospital Management System patientappointment.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T18:47:23.606Z

Reserved: 2026-07-03T18:52:05.127Z

Link: CVE-2026-14659

cve-icon Vulnrichment

Updated: 2026-07-06T18:47:19.678Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')