CVE-2026-14731
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile — higher than 10% of all known CVEs
Summary
A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /patientreport.php file. Manipulating the editid argument allows remote exploitation. The exploit has been publicly released, increasing the risk of attacks.
Risk Assessment
An attacker can remotely extract, modify, or delete database records, including sensitive patient medical and personal data, compromising the confidentiality and integrity of the system.
Recommendation
Immediately update the system to the latest version or apply a security patch. As a temporary measure, restrict access to /patientreport.php or deploy a Web Application Firewall (WAF) to block SQL injection attempts.
Original NVD description (English source)
A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patientreport.php. Executing a manipulation of the argument editid can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.