Which versions of Online Blood Bank Management System are affected by CVE-2026-10250?

Healthcare organizations using itsourcecode Online Blood Bank Management System 1.0 face significant risk of unauthorized access to blood bank operations and patient records due to a high-severity…

Is there a public PoC exploit available for CVE-2026-10250?

Yes, a public proof-of-concept exploit is available for CVE-2026-10250. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10250?

Within 24 hours: Identify all instances of itsourcecode Online Blood Bank Management System 1.0, document affected systems and data scope, and review access logs for exploitation attempts targeting /admin/campsdetails.php. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the hospital parameter, implement network segmentation to restrict administrative access to authorized networks only, and enforce parameterized database queries if source code modifications are available. Within 30 days: Monitor itsourcecode vendor for security updates and patched versions; establish a timeline for upgrade or migration to an alternative blood bank management solution with active vendor support.

Online Blood Bank Management System CVE-2026-10250

Q: What is the CVSS score of CVE-2026-10250?

CVE-2026-10250 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33625 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-8wv4-h2m6-qrm3

PHP SQLi Online Blood Bank Management System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 11:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 11:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 11:20 vuln.today

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Online Blood Bank Management System 1.0. The affected element is an unknown function of the file /admin/campsdetails.php. Performing a manipulation of the argument hospital results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Online Blood Bank Management System 1.0 allows remote unauthenticated attackers to manipulate the 'hospital' parameter in /admin/campsdetails.php to inject arbitrary SQL queries. Publicly available exploit code exists, increasing the practical risk despite the application being a relatively niche PHP-based healthcare management product. No CISA KEV listing or EPSS score is provided in the source intelligence, so widespread automated exploitation is not confirmed.

Technical ContextAI

The affected product is itsourcecode Online Blood Bank Management System version 1.0, a PHP-based web application used for managing blood donation camps and donor records (CPE: cpe:2.3:a:itsourcecode:online_blood_bank_management_system). The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input in the 'hospital' GET/POST parameter of /admin/campsdetails.php is concatenated directly into a SQL query without parameterization or sanitization. This is a common pattern in legacy PHP applications that use mysql_query or mysqli without prepared statements, allowing query structure manipulation through standard SQLi payloads such as UNION-based or boolean-based injection.

RemediationAI

No vendor-released patch identified at time of analysis; itsourcecode has not published a security advisory or fixed release for this issue in the provided references. As compensating controls, administrators should restrict access to /admin/campsdetails.php using IP allowlists or web server authentication (htaccess) to prevent unauthenticated reachability, with the trade-off that legitimate remote administrators must use approved networks or VPN. Deploying a WAF rule that blocks SQL meta-characters and common injection patterns in the 'hospital' parameter provides interim protection but may produce false positives on legitimate hospital names containing apostrophes. The long-term fix is to refactor /admin/campsdetails.php to use parameterized queries (PDO prepared statements with bound parameters) for the 'hospital' input; given the small codebase, all admin PHP files should be audited for the same pattern. The public exploit and tracking are at https://github.com/zhengdexu-bot/zhengdexu/issues/2 and https://vuldb.com/cve/CVE-2026-10250.