Is there a public PoC exploit available for CVE-2026-14619?

Yes, a public proof-of-concept exploit is available for CVE-2026-14619. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-14619

Q: What is the CVSS score of CVE-2026-14619?

CVE-2026-14619 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41658 LOW

SQL Injection (CWE-89)

2026-07-04 VulDB

GHSA-xghp-mpq3-hr44

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable via HTTP, low complexity; PR:L confirmed by CVSS 4.0 input; partial C/I/A reflects bounded database-level impact without scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 04, 2026 - 08:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 08:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 04, 2026 - 07:47 vuln.today

DescriptionCVE.org

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /medicine.php. This manipulation of the argument editid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged authenticated remote attackers to manipulate database queries via the editid parameter in /medicine.php. The attack achieves partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept exploit has been published (tracked via GitHub issue), lowering the barrier for exploitation; however, no active exploitation has been confirmed by CISA KEV at time of analysis.

Technical ContextAI

The affected product is a PHP-based hospital management application distributed by itsourcecode, identified by CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The vulnerability class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that the editid HTTP parameter in /medicine.php is passed to a database query without adequate sanitization or the use of parameterized statements. This is a classic unsanitized user input reaching a SQL execution context in a PHP/MySQL stack. The wildcard CPE version range suggests all known releases may be affected, including the named 1.0 version.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace dynamic SQL string concatenation in /medicine.php with parameterized queries or prepared statements (e.g., PDO with bound parameters in PHP), which eliminates the injection surface entirely. As an immediate compensating control, input validation should be applied to editid to enforce an expected integer or alphanumeric format, rejecting any input containing SQL metacharacters - note this is defense-in-depth only and not a substitute for parameterized queries. Network-level controls such as a web application firewall (WAF) rule targeting SQL injection patterns on the /medicine.php endpoint can reduce automated exploitation risk, though WAF rules can be bypassed by determined attackers. Restricting access to the application to trusted internal networks or VPN reduces the network-accessible attack surface. VulDB tracking is available at https://vuldb.com/vuln/376136 and the CVE entry at https://vuldb.com/cve/CVE-2026-14619.