Is there a public PoC exploit available for CVE-2026-13530?

Yes, a public proof-of-concept exploit is available for CVE-2026-13530. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13530

Q: What is the CVSS score of CVE-2026-13530?

CVE-2026-13530 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40027 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-88wf-x37g-mj38

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requires low-privilege authentication (PR:L); SQL injection yields partial data read/write with no confirmed scope change or full database admin access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 04:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 04:02 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the Appointment Handler endpoint /appointmentdetail.php to remote database manipulation via the unsanitized editid parameter. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege authentication is required and a public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. While not listed in CISA KEV, the combination of network reachability, trivial exploitation complexity, and live PoC code makes this a concrete risk for any organization running this codebase in production.

Technical ContextAI

The affected product is a PHP-based Hospital Management System distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*), primarily packaged as an educational or demo web application. The root cause is CWE-89 - Improper Neutralization of Special Elements Used in an SQL Command - meaning the PHP code in /appointmentdetail.php concatenates user-supplied input directly into a SQL query without using parameterized statements or prepared queries. The editid parameter, used to identify and retrieve appointment records in the Appointment Handler component, is the injection point. This class of flaw allows an attacker to alter the logic of the backend SQL statement, enabling data extraction, modification, or, depending on database account permissions, potentially broader database operations.

RemediationAI

No vendor-released patch has been identified at time of analysis. Given that itsourcecode publishes educational demo code rather than maintained enterprise software, a formal patch release is unlikely in the near term. The correct code-level fix is to replace dynamic SQL string concatenation in /appointmentdetail.php with PHP PDO or MySQLi prepared statements and parameterized queries for the editid input, directly resolving CWE-89. As compensating controls for organizations that cannot immediately modify the code: restrict the appointment management interface to authenticated internal network users only (firewall or reverse proxy ACL), and deploy a Web Application Firewall rule to detect and block SQL injection payloads in the editid parameter - noting WAF rules can be bypassed with encoding tricks and are not a permanent fix. Audit and reduce the privileges of the database account used by the application to the minimum required (SELECT/INSERT/UPDATE on specific tables, no FILE or DROP rights) to limit the impact of successful exploitation. Production deployment of this educational codebase is strongly discouraged.