CVE-2026-19934
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Hospital Management System 1.0 from itsourcecode has a SQL Injection vulnerability in /vieworder.php. Manipulation of the 'delid' argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.
Risk Assessment
Risk of unauthorized access to the hospital system's database, potentially leading to patient data exposure and system integrity compromise.
Recommendation
Apply vendor patches or restrict access to /vieworder.php. Conduct a security audit of the system.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /vieworder.php. The manipulation of the argument delid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.