CVE-2026-77025
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A weakness has been identified in itsourcecode Hospital Management System 1.0. It affects an unknown part of the file /viewappointmentpending.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely, and the exploit is publicly available.
Risk Assessment
The risk includes remote access to the database, potentially leading to disclosure of sensitive medical data, data integrity compromise, or full system takeover. The public exploit increases the likelihood of attack.
Recommendation
It is recommended to immediately apply patches or updates to the system, and to validate and sanitize input in the delid parameter. Also, restrict access to the system and monitor logs for suspicious SQL queries.
Other vulnerabilities in itsourcecode Hospital Management System
See all- CVE-2026-16009Medium
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /prescriptionorderdetail.php. The attack is performed by manipulating the delid argument, allowing remote SQL injection. The exploit is publicly available.
- CVE-2026-78112Medium
A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.
- CVE-2026-75088Medium
A vulnerability was determined in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewbilling.php. Manipulation of the argument delid leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-75087Medium
A vulnerability was found in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewdepartment.php. Manipulation of the argument delid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-19894Medium
In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.
- CVE-2026-19347Medium
A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in /viewdoctor.php. Manipulating the delid argument allows remote SQL queries. The exploit is public.
- CVE-2026-19071Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewappointment.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit has been published.
- CVE-2026-19070Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewadmin.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit is now public.
- CVE-2026-19069Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentrecord.php, via manipulation of the argument editid. The attack can be performed remotely. The exploit has been publicly disclosed.
- CVE-2026-19068Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentdetail.php, via manipulation of the argument patientid. The attack can be performed remotely. The exploit has been made public.
Original NVD description (English source)
A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.