Is there a public PoC exploit available for CVE-2026-13578?

Yes, a public proof-of-concept exploit is available for CVE-2026-13578. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13578

Q: What is the CVSS score of CVE-2026-13578?

CVE-2026-13578 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40120 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-m9j8-rwpf-q8xx

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requires low-privilege authentication; no scope change; low CIA impact consistent with limited database account privileges assumed by the application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:25 vuln.today

Severity Changed

Jun 29, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 15:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /patientdetail.php. Performing a manipulation of the argument editid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /patientdetail.php endpoint to database manipulation via the unsanitized editid parameter, reachable by any low-privileged authenticated user over the network. A public proof-of-concept exploit is available (referenced via GitHub issue), lowering the skill barrier for exploitation against any deployed instance. The CVSS 4.0 score of 2.1 reflects low per-impact ratings across confidentiality, integrity, and availability, but SQL injection vulnerabilities routinely exceed their scored impact bounds when database accounts carry excess privileges - no public exploitation has been confirmed in CISA KEV.

Technical ContextAI

The affected application is a PHP-based hospital management system developed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), a classic unsanitized input flaw where the editid HTTP parameter in /patientdetail.php is concatenated directly into a SQL query without parameterization, escaping, or type enforcement. This pattern is endemic to legacy PHP applications that do not use PDO or MySQLi prepared statements. The wildcard in the CPE version field indicates NVD has not bounded the affected version range beyond the reported 1.0 release.

RemediationAI

No vendor-released patch has been identified at time of analysis - the itsourcecode project site (https://itsourcecode.com/) does not reference a fix for this CVE. The primary remediation is to rewrite the editid handling in /patientdetail.php using PHP PDO or MySQLi prepared statements with bound parameters, eliminating the injection vector entirely. As an immediate compensating control, restrict application access to trusted internal networks or VPN-only access, preventing opportunistic external exploitation. Deploy a web application firewall rule to block SQL metacharacters (single quotes, UNION, SELECT keywords) in the editid parameter - note this approach is bypassable with encoding techniques and should not be treated as a permanent fix. Additionally, audit and reduce the database account privileges used by the application to SELECT-only on necessary tables, and revoke FILE, DROP, and EXECUTE permissions to limit post-exploitation impact. Given this appears to be a demo or educational codebase, consider whether production deployment is appropriate at all.