CVE-2026-14638
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /patient.php file. An attacker can remotely manipulate the editid argument, leading to unauthorized database access. The exploit has been published and may be used.
Risk Assessment
The risk includes potential leakage of sensitive patient data, modification or deletion of medical records, and system takeover.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, validate and sanitize all input data, especially the editid argument.
Other vulnerabilities in itsourcecode Hospital Management System
See all- CVE-2026-16009Medium
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /prescriptionorderdetail.php. The attack is performed by manipulating the delid argument, allowing remote SQL injection. The exploit is publicly available.
- CVE-2026-78112Medium
A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.
- CVE-2026-77025Medium
A weakness has been identified in itsourcecode Hospital Management System 1.0. It affects an unknown part of the file /viewappointmentpending.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely, and the exploit is publicly available.
- CVE-2026-75088Medium
A vulnerability was determined in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewbilling.php. Manipulation of the argument delid leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-75087Medium
A vulnerability was found in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewdepartment.php. Manipulation of the argument delid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-19894Medium
In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.
- CVE-2026-19347Medium
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in /viewdoctor.php. Manipulating the delid argument allows remote SQL queries. The exploit is public.
- CVE-2026-19071Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewappointment.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit has been published.
- CVE-2026-19070Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewadmin.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit is now public.
- CVE-2026-19069Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentrecord.php, via manipulation of the argument editid. The attack can be performed remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A flaw has been found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /patient.php. This manipulation of the argument editid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.