Is there a public PoC exploit available for CVE-2026-13532?

Yes, a public proof-of-concept exploit is available for CVE-2026-13532. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13532

Q: What is the CVSS score of CVE-2026-13532?

CVE-2026-13532 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40029 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-m93c-g2xr-j8hg

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQL injection requires low-privilege auth (PR:L); limited data exfiltration and modification impact with no scope change to external systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 05:46 vuln.today

DescriptionCVE.org

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /departmentDoctor.php. This manipulation of the argument deptid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /departmentDoctor.php endpoint to database manipulation via the unsanitized deptid parameter, allowing a remote low-privileged attacker to read, modify, or corrupt backend database records. The CVSS 4.0 vector (PR:L) confirms that a valid application account is required, limiting opportunistic exploitation. A public proof-of-concept exploit is available on GitHub (linked from VulDB), and no vendor patch has been identified at time of analysis, making compensating controls the only available remediation path.

Technical ContextAI

The affected product is a PHP-based hospital management web application distributed by itsourcecode.com, a source code repository commonly used for academic and student projects. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in SQL Command), indicating that user-supplied input from the deptid parameter in /departmentDoctor.php is concatenated directly into a SQL query without sanitization or parameterization. This is a textbook unsanitized input pattern in legacy PHP applications. The CPE string cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:* covers all versions, though only version 1.0 is explicitly named in the disclosure. The database backend is not specified in available data but is typical of MySQL or MariaDB in this application class.

RemediationAI

No vendor-released patch has been identified at time of analysis - the fix version is not independently confirmed from available data. Organizations running this application should immediately implement parameterized queries (prepared statements with PDO or MySQLi) in /departmentDoctor.php for the deptid parameter, which eliminates the injection vector at the root cause level. As a compensating control, a web application firewall (WAF) rule blocking SQL metacharacters (single quotes, UNION, SELECT, double dashes) in the deptid parameter can reduce exploitation risk with minimal operational disruption. If the /departmentDoctor.php functionality is not operationally required, disabling or removing the endpoint eliminates the attack surface entirely. Restricting application access to trusted internal networks reduces exposure given the PR:L requirement. Monitor VulDB at https://vuldb.com/vuln/374540 and itsourcecode.com for patch releases.