CVE-2026-19894
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.
Risk Assessment
SQL injection can allow an attacker to access sensitive data in the database, including patient data, which is a serious privacy and security breach.
Recommendation
Apply vendor patches immediately or restrict access to /viewmedicine.php, and conduct a security audit of the application.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.