Is there a public PoC exploit available for CVE-2026-13579?

Yes, a public proof-of-concept exploit is available for CVE-2026-13579. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-13579

Q: What is the CVSS score of CVE-2026-13579?

CVE-2026-13579 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40123 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-7pxf-qvvr-jq55

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requires authenticated patient session (PR:L); limited C/I/A reflects constrained DB impact without confirmed DBA-level privilege escalation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:26 vuln.today

Severity Changed

Jun 29, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 15:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated patient users to database-level attacks via the /patientchangepassword.php endpoint. The newpassword parameter is passed unsanitized into SQL queries, allowing an authenticated attacker to manipulate backend database operations - potentially reading, modifying, or deleting patient records. A public proof-of-concept exploit exists (GitHub issue linked from VulDB report), though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 2.1 reflects the limited real-world severity due to the authentication prerequisite and constrained impact scope.

Technical ContextAI

The affected product is a PHP-based Hospital Management System developed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*), a platform that publishes open-source demo/educational web applications. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the canonical SQL injection root cause. The /patientchangepassword.php script accepts a newpassword POST/GET argument and appears to interpolate it directly into a SQL query without parameterization or adequate input sanitization. This is a classic first-order SQL injection - user-supplied input directly controls query structure rather than being treated as data. Because the application is PHP-based, the likely database backend is MySQL/MariaDB, a common pairing in the itsourcecode project ecosystem.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched version is referenced in VulDB, NVD CPE data, or the itsourcecode.com site. The primary remediation is to replace direct SQL string interpolation in /patientchangepassword.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As a compensating control, deploying a Web Application Firewall (WAF) rule to detect and block SQL metacharacters in the newpassword field can reduce exploitation likelihood, though WAF bypasses are common for unsophisticated PHP apps. Administrators running this software in any environment with real patient data should consider taking the application offline until the code is patched, given the absence of an upstream fix. The VulDB disclosure is at https://vuldb.com/vuln/374585 and the POC at https://github.com/ltranquility/cve_submit/issues/21.