CVE-2026-16490
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In itsourcecode Hospital Management System 1.0, a vulnerability exists in an unknown function of the file /prescription.php. Manipulation of the editid argument results in SQL injection. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
The organization may face data leakage or modification in the database, including patient and prescription data, compromising privacy and system integrity.
Recommendation
Immediately apply a patch or upgrade to a version that fixes the vulnerability; if unavailable, restrict access to the /prescription.php file.
Other vulnerabilities in itsourcecode Hospital Management System
See all- CVE-2026-16009Medium
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /prescriptionorderdetail.php. The attack is performed by manipulating the delid argument, allowing remote SQL injection. The exploit is publicly available.
- CVE-2026-78112Medium
A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.
- CVE-2026-77025Medium
A weakness has been identified in itsourcecode Hospital Management System 1.0. It affects an unknown part of the file /viewappointmentpending.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely, and the exploit is publicly available.
- CVE-2026-75088Medium
A vulnerability was determined in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewbilling.php. Manipulation of the argument delid leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-75087Medium
A vulnerability was found in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewdepartment.php. Manipulation of the argument delid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-19894Medium
In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.
- CVE-2026-19347Medium
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in /viewdoctor.php. Manipulating the delid argument allows remote SQL queries. The exploit is public.
- CVE-2026-19071Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewappointment.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit has been published.
- CVE-2026-19070Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewadmin.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit is now public.
- CVE-2026-19069Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentrecord.php, via manipulation of the argument editid. The attack can be performed remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.