Is there a public PoC exploit available for CVE-2026-14638?

Yes, a public proof-of-concept exploit is available for CVE-2026-14638. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-14638

Q: What is the CVSS score of CVE-2026-14638?

CVE-2026-14638 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41685 LOW

SQL Injection (CWE-89)

2026-07-04 VulDB

GHSA-m6rj-37g4-f8rj

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible SQLi via authenticated low-privilege session (PR:L); partial read/write impact on patient data; no evidence of availability disruption from description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 04, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 18:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 04, 2026 - 18:21 vuln.today

DescriptionCVE.org

A flaw has been found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /patient.php. This manipulation of the argument editid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient records to partial disclosure and modification via the editid parameter in /patient.php. The CVSS 4.0 vector (PR:L) confirms exploitation requires a low-privilege authenticated session, limiting the immediate attack surface to users who can log in. A public proof-of-concept exploit exists (E:P), elevating practical risk above the base score of 5.3, though no CISA KEV listing confirms active exploitation at time of analysis.

Technical ContextAI

The affected product is a PHP-based Hospital Management System (version 1.0) published by itsourcecode, identified via CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection arising from insufficient sanitization or lack of parameterized queries when processing the editid input in /patient.php. This pattern is typical of PHP applications that directly concatenate user-supplied values into SQL query strings rather than using PDO prepared statements or MySQLi bound parameters. The backend database is not specified in available data but is consistent with MySQL/MariaDB commonly bundled with itsourcecode projects.

RemediationAI

No vendor-released patch has been identified at time of analysis for itsourcecode Hospital Management System 1.0. The primary fix is to refactor /patient.php to replace direct SQL string interpolation of the editid parameter with PDO or MySQLi prepared statements with bound parameters, which eliminates the injection surface entirely. As an immediate compensating control, input validation should enforce that editid accepts only integer values, rejecting non-numeric input at the application layer - this reduces exploit surface but does not fully remediate the root cause. Deploying a Web Application Firewall rule targeting SQL metacharacter patterns on the /patient.php endpoint can provide additional detection and blocking, though WAF bypass techniques exist for determined attackers. Access to the patient management module should be restricted to the minimum necessary authenticated roles. Monitor https://vuldb.com/vuln/376154 for any upstream patch release.