CVE-2026-14774
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the /paymentdischarge.php file. An attacker can remotely manipulate the patientid argument, leading to unauthorized database access. The exploit has been publicly disclosed and may be used.
Risk Assessment
The risk includes potential leakage of sensitive patient data and the possibility of data modification or deletion, which could disrupt system operations and cause financial and reputational damage.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and parameterized SQL queries for all arguments passed to /paymentdischarge.php.
Original NVD description (English source)
A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /paymentdischarge.php. This manipulation of the argument patientid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.