Is there a public PoC exploit available for CVE-2026-13548?

Yes, a public proof-of-concept exploit is available for CVE-2026-13548. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13548

Q: What is the CVSS score of CVE-2026-13548?

CVE-2026-13548 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40048 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-pqf9-gv8x-vr6w

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection gated by low-privilege authentication (PR:L); partial C/I/A impact as attacker can read, modify, or disrupt database contents within the vulnerable system scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 09:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 09:17 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /doctortimings.php. The manipulation of the argument editid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /doctortimings.php endpoint to database manipulation via the unsanitized editid parameter, allowing a remote low-privilege authenticated attacker to read, modify, or partially disrupt backend database contents. The CVSS 4.0 vector (PR:L) confirms that some form of application authentication is required, limiting opportunistic mass exploitation, but a publicly available proof-of-concept exploit on GitHub materially lowers the barrier for targeted attacks. No patch has been released; the vulnerability is not listed in the CISA KEV catalog, but the sensitivity of healthcare data in scope makes it a meaningful risk for any production deployment.

Technical ContextAI

This is a CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) flaw in a PHP-based open-source hospital management application published by itsourcecode. The affected file /doctortimings.php accepts user-controlled input through the editid parameter - almost certainly passed as a GET or POST argument to construct a database query - without applying parameterized statements or adequate input sanitization. The CPE string cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not scoped the flaw to a specific version range beyond the reported 1.0 release. As is typical for itsourcecode PHP applications, the backend is likely MySQL or MariaDB, both of which support stacked queries and UNION-based injection techniques that could enable data extraction, modification, or authentication bypass depending on database privilege configuration.

RemediationAI

No vendor-released patch has been identified at the time of analysis. The definitive fix requires modifying /doctortimings.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters) for the editid input, which eliminates the CWE-89 root cause entirely. As an interim compensating control, administrators should enforce strict server-side input validation on editid to reject non-integer values, which limits injection surface without resolving the underlying issue. Deploying a Web Application Firewall with SQL injection detection rules (e.g., ModSecurity with the OWASP Core Rule Set) can detect and block common injection patterns, though WAF bypass is possible against a determined attacker. The database account used by the application should be restricted to the minimum necessary privileges - SELECT/INSERT/UPDATE only on required tables - to prevent DROP, LOAD_FILE, or INTO OUTFILE abuse if injection succeeds. Where feasible, restrict access to the application to trusted internal networks only and avoid internet-facing exposure until a patch is available. See https://vuldb.com/vuln/374556 for additional context.