Is there a public PoC exploit available for CVE-2026-11514?

Yes, a public proof-of-concept exploit is available for CVE-2026-11514. Prioritise patching immediately. EPSS: 0.0%.

Hospital Management System CVE-2026-11514

Q: What is the CVSS score of CVE-2026-11514?

CVE-2026-11514 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35056 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-2493-92j5-5vh6

PHP SQLi Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:51 vuln.today

Severity Changed

Jun 08, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /addpatient.php. This manipulation of the argument admissiontme causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient database records to authenticated remote attackers via the unsanitized admissiontme parameter in /addpatient.php. A publicly available proof-of-concept (published on GitHub) lowers the exploitation barrier, though the CVSS 4.0 score of 2.1 reflects constrained impact - limited to partial data read/write with no scope change to subsequent systems. No active exploitation has been confirmed (not in CISA KEV), but the healthcare context amplifies regulatory significance even for low-severity data exposure.

Technical ContextAI

The affected application is a PHP-based hospital management platform (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*) distributed by itsourcecode.com, commonly used as a reference or small-deployment system. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input to the admissiontme field in the patient admission form is concatenated directly into a backend SQL query without parameterization or escaping. This is a classic PHP/MySQL pattern failure - absence of PDO prepared statements or MySQLi bind_param calls. The CVSS 4.0 vector confirms network delivery (AV:N), no attack complexity (AC:L), and no additional attack requirements (AT:N), meaning the injection point is straightforwardly reachable over HTTP POST once authenticated.

RemediationAI

No vendor-released patch has been identified at time of analysis for itsourcecode Hospital Management System 1.0. For developers maintaining this codebase, the primary fix is replacing direct SQL string concatenation in /addpatient.php with parameterized queries using PHP's PDO or MySQLi prepared statements for the admissiontme input - this eliminates the injection point at the root cause. As an interim compensating control, administrators should restrict access to the application to trusted internal networks or VPN only, removing the AV:N (network-accessible) condition and preventing remote exploitation; note this impacts legitimate remote access workflows. A WAF rule blocking common SQL meta-characters (single quotes, SQL keywords) in the admissiontme POST parameter provides additional layered defense but is bypassable with encoding techniques. Exploit details are documented at https://github.com/ltranquility/vuln_submit/issues/15 and the VulDB entry at https://vuldb.com/vuln/369134.