Which versions of Online Blood Bank Management System are affected by CVE-2026-10249?

itsourcecode Online Blood Bank Management System version 1.0 contains an unauthenticated SQL injection vulnerability allowing attackers to extract or modify patient blood bank records and operational…

Is there a public PoC exploit available for CVE-2026-10249?

Yes, a public proof-of-concept exploit is available for CVE-2026-10249. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10249?

Within 24 hours: Identify and document all instances of itsourcecode 1.0 in production; restrict network access to /admin/viewrequest.php to authorized staff only. Within 7 days: Deploy Web Application Firewall rules blocking SQL injection patterns on the 'ID' parameter of /admin/viewrequest.php; implement database account privilege minimization; enable comprehensive logging of administrative interface queries. Within 30 days: Execute migration to a patched/supported blood bank management system or replace itsourcecode 1.0 entirely; document replacement timeline for regulatory compliance records.

Online Blood Bank Management System CVE-2026-10249

Q: What is the CVSS score of CVE-2026-10249?

CVE-2026-10249 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33624 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-w59q-8pf5-r5pc

PHP SQLi Online Blood Bank Management System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 11:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 11:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 11:21 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/viewrequest.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Online Blood Bank Management System 1.0 allows remote unauthenticated attackers to manipulate the 'ID' parameter on /admin/viewrequest.php to inject arbitrary SQL into backend database queries. Publicly available exploit code exists per VulDB, raising the practical risk despite the moderate CVSS 7.3 score. No CISA KEV listing or EPSS data was provided, so widespread automated exploitation cannot be confirmed at this time.

Technical ContextAI

The affected component is a PHP-based web application (Online Blood Bank Management System v1.0) distributed via itsourcecode, identified by CPE cpe:2.3:a:itsourcecode:online_blood_bank_management_system. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the 'ID' GET/POST parameter on the admin viewrequest.php endpoint is concatenated directly into a SQL query without parameterization or sanitization. This is a classic PHP/MySQL anti-pattern where developer-supplied input flows into mysqli_query or similar without prepared statements, enabling boolean-based, union-based, or error-based SQLi techniques.

RemediationAI

No vendor-released patch identified at time of analysis - itsourcecode has not published a fixed version in the references provided. Defenders should apply compensating controls: rewrite the affected query in /admin/viewrequest.php to use PDO or mysqli prepared statements with bound parameters for the 'ID' argument, cast the parameter to an integer (intval) before use if it is expected to be numeric, and audit other admin endpoints for the same pattern. As an immediate mitigation, restrict access to /admin/ paths via IP allowlist or HTTP authentication at the web server layer (trade-off: legitimate admin access must be re-provisioned), deploy a WAF rule blocking SQLi metacharacters on the ID parameter (trade-off: bypassable by sophisticated attackers using encoding), and disable internet exposure of the admin interface entirely if feasible. Monitor VulDB entry https://vuldb.com/vuln/367527 and the vendor site https://itsourcecode.com/ for an official patched release.