CVE-2026-14731
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /patientreport.php. Manipulating the editid argument allows remote exploitation. A public exploit is available and could be used for attacks.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized access, modification, or deletion of sensitive patient data, as well as system compromise.
Recommendation
Immediately update the system to the latest version or apply a security patch. In the meantime, restrict access to /patientreport.php and validate all input data.
Other vulnerabilities in itsourcecode Hospital Management System
See all- CVE-2026-16009Medium
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /prescriptionorderdetail.php. The attack is performed by manipulating the delid argument, allowing remote SQL injection. The exploit is publicly available.
- CVE-2026-78112Medium
A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.
- CVE-2026-77025Medium
A weakness has been identified in itsourcecode Hospital Management System 1.0. It affects an unknown part of the file /viewappointmentpending.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely, and the exploit is publicly available.
- CVE-2026-75088Medium
A vulnerability was determined in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewbilling.php. Manipulation of the argument delid leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-75087Medium
A vulnerability was found in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewdepartment.php. Manipulation of the argument delid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-19894Medium
In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.
- CVE-2026-19347Medium
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in /viewdoctor.php. Manipulating the delid argument allows remote SQL queries. The exploit is public.
- CVE-2026-19071Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewappointment.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit has been published.
- CVE-2026-19070Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewadmin.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit is now public.
- CVE-2026-19069Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentrecord.php, via manipulation of the argument editid. The attack can be performed remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patientreport.php. Executing a manipulation of the argument editid can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.