Is there a public PoC exploit available for CVE-2026-13541?

Yes, a public proof-of-concept exploit is available for CVE-2026-13541. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13541

Q: What is the CVSS score of CVE-2026-13541?

CVE-2026-13541 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40041 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-vf94-fqp2-59p2

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Requires low-privilege authentication (PR:L); network-reachable via web form (AV:N); limited and symmetric impact across C/I/A consistent with constrained DB role.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 07:37 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 07:37 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 07:17 vuln.today

DescriptionCVE.org

A weakness has been identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /doctorchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the backend database to authenticated remote attackers through the newpassword parameter of /doctorchangepassword.php. An attacker holding low-privilege credentials - such as a doctor account - can craft malicious SQL payloads to read, modify, or potentially delete database records. A public exploit exists per the CVSS 4.0 E:P modifier and a referenced GitHub issue; no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The affected application is a PHP-based hospital management system distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the /doctorchangepassword.php endpoint incorporates the user-supplied newpassword POST parameter directly into a SQL query without parameterization or adequate sanitization. Because this endpoint is associated with a password-change workflow, the injected value bypasses typical output-encoding defenses and reaches the database layer unfiltered. The application stack is PHP with a relational database backend, consistent with typical itsourcecode tutorial projects.

RemediationAI

No vendor-released patch has been identified at time of analysis; the itsourcecode.com project does not appear to have published a fix. The primary remediation is to rewrite the SQL query in /doctorchangepassword.php to use parameterized prepared statements (e.g., PHP PDO or MySQLi prepared statements), which eliminates the injection vector entirely. As an interim compensating control, deploy a Web Application Firewall (WAF) rule to detect and block SQL metacharacters in the newpassword parameter - note this may cause false positives for users with special characters in passwords. Additionally, restrict network access to the application to trusted internal networks only, removing internet-facing exposure. Enforce the principle of least privilege on the database account used by the application so it cannot perform DDL operations (DROP, ALTER) even if injection is achieved. VulDB entry: https://vuldb.com/vuln/374549.