Is there a public PoC exploit available for CVE-2026-11513?

Yes, a public proof-of-concept exploit is available for CVE-2026-11513. Prioritise patching immediately. EPSS: 0.0%.

Hospital Management System CVE-2026-11513

Q: What is the CVSS score of CVE-2026-11513?

CVE-2026-11513 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35055 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-6vmf-w458-7x2p

PHP SQLi Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:51 vuln.today

Severity Changed

Jun 08, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminaccount.php. The manipulation of the argument Date results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 allows remote low-privileged attackers to manipulate backend database queries via the 'Date' parameter in /adminaccount.php. The vulnerability is PHP-based (CWE-89) and publicly exploitable code exists via a GitHub submission linked through VulDB. Despite remote reachability, the CVSS 4.0 score of 2.1 reflects constrained real-world impact: low privileges are required, and the scope is fully contained with only low-level confidentiality, integrity, and availability consequences. No public patch has been identified at time of analysis.

Technical ContextAI

The affected product is itsourcecode Hospital Management System version 1.0, a PHP-based web application (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), meaning user-supplied input from the 'Date' parameter in the administrative page /adminaccount.php is concatenated into a database query without adequate sanitization or parameterization. This is a classic unsanitized PHP-to-SQL pattern, commonly found in educational or hobbyist codebases from itsourcecode.com, which distributes open-source school and hospital management scripts. The wildcard version in the CPE string suggests all distributed versions may share the same vulnerable code path.

RemediationAI

No vendor-released patch has been identified at time of analysis. The itsourcecode.com project does not appear to maintain a formal security advisory process, so users should not expect an official fix. The most effective compensating control is to replace all direct string concatenation in SQL queries within /adminaccount.php with PHP PDO or MySQLi prepared statements and parameterized queries, which eliminates the injection vector at the root cause. As an immediate workaround, restrict access to /adminaccount.php at the web server level (e.g., via .htaccess or nginx location blocks) to trusted IP ranges only, reducing the attack surface to internal networks. Deploying a web application firewall (WAF) rule to detect and block SQL metacharacter sequences in the 'Date' parameter can also reduce exploitation likelihood, though WAF bypass is a known trade-off. Organizations running this system in environments handling real patient data should evaluate replacement with a maintained, security-audited alternative. References: https://vuldb.com/vuln/369133, https://github.com/ltranquility/vuln_submit/issues/14.