Is there a public PoC exploit available for CVE-2026-13542?

Yes, a public proof-of-concept exploit is available for CVE-2026-13542. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13542

Q: What is the CVSS score of CVE-2026-13542?

CVE-2026-13542 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40042 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-fp25-jqx9-jfw4

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Low-privilege authentication required (PR:L); no scope change to external systems; partial CIA impact consistent with constrained database account permissions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 07:37 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 07:37 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 07:18 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /doctorprofile.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /doctorprofile.php endpoint to remote exploitation via the doctorname parameter, allowing an authenticated attacker to execute arbitrary SQL commands against the backend database. Affected systems risk unauthorized access to, modification of, or partial disruption of sensitive medical and staff records stored within the application. A public proof-of-concept exploit has been disclosed on GitHub (CVSS 4.0 E:P), significantly lowering the technical barrier for exploitation despite the moderate base score; no CISA KEV listing is present at time of analysis.

Technical ContextAI

The affected product is itsourcecode Hospital Management System version 1.0, a PHP-based web application for managing hospital operations including doctor profiles (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), the canonical SQL injection root cause. In PHP applications of this class, CWE-89 typically arises from direct string concatenation of unsanitized user input into SQL query strings rather than the use of parameterized queries or prepared statements. The doctorname parameter accepted by /doctorprofile.php is passed unsanitized into a database query, allowing an attacker to alter query logic. The wildcard version in the CPE string suggests the issue may span multiple versions beyond the explicitly referenced 1.0 release.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix is a source-code correction in /doctorprofile.php replacing any direct SQL string concatenation involving doctorname with parameterized queries or prepared statements using PHP's PDO or MySQLi APIs - this eliminates the CWE-89 root cause entirely. As compensating controls while awaiting a patch: deploy a Web Application Firewall with SQL injection detection rules to intercept malicious payloads at the network layer (trade-off: WAF rules can be bypassed via encoding or timing and do not fix the underlying flaw); enforce strict least-privilege on the application's database account, restricting it to only the tables and operations it requires, which limits data exposure if injection succeeds; and audit all application user accounts to remove unnecessary or default credentials, since the PR:L requirement means any valid account enables attack. The public PoC is documented at https://github.com/ltranquility/submit/issues/18.