Description
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientprofile.php. Performing a manipulation of the argument patientname results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-07-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Hospital Management System 1.0’s patientprofile.php script accepts the patientname parameter without proper sanitization, allowing attackers to inject arbitrary SQL. This flaw reflects code-level weaknesses identified as CWE‑74, which involves improper neutralization of input, and CWE‑89, which concerns improper neutralization of special elements used in SQL commands.

Affected Systems

itsourcecode Hospital Management System 1.0, specifically the patientprofile.php component that processes the patientname argument. No patch is provided in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 denotes moderate severity, while the EPSS score of <1% indicates a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. However, the attacker can trigger the injection remotely by sending crafted HTTP requests to patientprofile.php, and public exploit code has already been released, making a targeted attack a realistic threat if the application remains vulnerable.

Generated by OpenCVE AI on July 23, 2026 at 15:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Validate and sanitize the patientname input or use parameterized queries to ensure SQL statements are not concatenated with user input.
  • Restrict access to patientprofile.php to authenticated staff with the appropriate role to limit the attack surface.
  • Verify if itsourcecode has released an update or patch for version 1.0; apply it as soon as available or, if not, monitor the vendor’s website for a correct fix.

Generated by OpenCVE AI on July 23, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientprofile.php. Performing a manipulation of the argument patientname results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title itsourcecode Hospital Management System patientprofile.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:50:28.120Z

Reserved: 2026-07-04T08:48:15.419Z

Link: CVE-2026-14730

cve-icon Vulnrichment

Updated: 2026-07-06T16:36:07.934Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T16:00:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')