CVE-2026-19364
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in itsourcecode Hospital Management System 1.0 affects an unknown function in the file /viewdoctorconsultancycharge.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized access, modification, or deletion of data in the hospital system.
Recommendation
Apply vendor patches or restrict access to /viewdoctorconsultancycharge.php. Use parameterized queries to prevent SQL injection.
Original NVD description (English source)
A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.