Description
A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-08-18
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection vulnerability exists in /viewroom.php when the delid parameter is manipulated. By inserting specially crafted payloads the attacker can alter or retrieve data from the database, potentially disrupting the hospital management system and exposing sensitive patient information.

Affected Systems

itsourcecode Hospital Management System version 1.0, accessed via the viewroom.php page.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly available exploit. Attackers can reach the vulnerable endpoint remotely, possibly leveraging public exposure to craft and send malicious requests to the delid parameter.

Generated by OpenCVE AI on August 18, 2026 at 01:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest vendor patch or upgrade to a version that does not contain the vulnerable code.
  • Sanitize and validate all user input, and use prepared statements or ORM to prevent unsanitized SQL concatenation.
  • Limit database user privileges to only the operations required by the application, reducing the damage that can be caused by injection.

Generated by OpenCVE AI on August 18, 2026 at 01:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Hospital Management System viewroom.php sql injection
First Time appeared Itsourcecode
Itsourcecode hospital Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode hospital Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Hospital Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-18T00:15:09.459Z

Reserved: 2026-08-17T16:27:51.136Z

Link: CVE-2026-75086

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T01:16:42.673

Modified: 2026-08-18T01:16:42.673

Link: CVE-2026-75086

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T02:00:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')