CVE-2026-19972
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Risk Assessment
SQL injection could allow an attacker to access sensitive patient data or modify the database, posing a serious threat to privacy and system integrity.
Recommendation
It is recommended to apply patches immediately, use parameterized queries, and restrict database privileges.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.