CVE-2026-20000
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in file /viewprescriptionrecord.php via the delid argument. The attack can be launched remotely, and the exploit is now public.
Risk Assessment
An attacker can manipulate SQL queries, potentially leading to unauthorized access to medical data or modification, and compromise database integrity.
Recommendation
Immediately apply patches or temporarily disable access to /viewprescriptionrecord.php, and use parameterized queries to prevent SQL injection.
Original NVD description (English source)
A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.