Is there a public PoC exploit available for CVE-2026-13496?

Yes, a public proof-of-concept exploit is available for CVE-2026-13496. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13496

Q: What is the CVSS score of CVE-2026-13496?

CVE-2026-13496 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39994 LOW

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-mvpm-j6cr-9gjm

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requiring low-privilege auth (PR:L per CVSS 4.0 source vector); limited C/I/A impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 28, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 28, 2026 - 13:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 28, 2026 - 13:15 vuln.today

DescriptionCVE.org

A vulnerability was found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /ajaxmedicine.php. The manipulation of the argument medicineid results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /ajaxmedicine.php endpoint to database manipulation via the unsanitized medicineid parameter, exploitable by any low-privilege authenticated user over the network. A public proof-of-concept has been published on GitHub, materially lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of public exploit code, a medical data context, and low attack complexity makes this a credible risk for any organization running this software.

Technical ContextAI

The affected product is a PHP-based hospital management application distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the medicineid parameter accepted by /ajaxmedicine.php is concatenated directly into a backend SQL query without parameterization or adequate input sanitization. This is a classic PHP unsanitized query construction flaw, allowing an attacker to alter query logic, extract schema data, read sensitive records, or modify database contents depending on the database account's privileges.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix requires a code-level change in /ajaxmedicine.php: replace any direct string interpolation of medicineid into SQL queries with parameterized prepared statements using PDO or MySQLi, which eliminates the injection surface entirely. As an immediate compensating control, restrict access to /ajaxmedicine.php to known internal IP ranges via web server configuration (e.g., Apache Require ip or nginx allow/deny directives), accepting the trade-off that remote staff or legitimate API consumers may lose access. Deploying a WAF rule targeting SQL injection patterns on the medicineid parameter adds detection and blocking without service interruption but may produce false positives if legitimate medicine IDs contain special characters. Monitor VulDB entry https://vuldb.com/vuln/374491 and the vendor site https://itsourcecode.com/ for patch releases.