CVE-2026-75086
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /viewroom.php. Manipulation of the argument delid in an unknown function allows remote attack execution. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access, modification, or deletion. The public exploit increases the risk of exploitation.
Recommendation
Apply patches immediately or temporarily disable access to /viewroom.php. Also use parameterized queries to prevent SQL injection.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.