Is there a public PoC exploit available for CVE-2026-14717?

Yes, a public proof-of-concept exploit is available for CVE-2026-14717. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-14717

Q: What is the CVSS score of CVE-2026-14717?

CVE-2026-14717 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41731 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-mhhc-cwmf-8h5f

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requiring low-privilege patient credentials (PR:L); limited C/I/A impact confined to application database records with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 07:22 vuln.today

Severity Changed

Jul 05, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 07:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /patientlogin.php. Performing a manipulation of the argument loginid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-level privileges to manipulate the loginid parameter in /patientlogin.php, enabling unauthorized database read, modification, or deletion operations. The vulnerability scores 5.3 on CVSS 4.0 and is compounded by a publicly available proof-of-concept exploit published on GitHub, materially lowering the barrier to opportunistic attack. No CISA KEV listing has been identified, but the public POC and low attack complexity make any internet-exposed deployment an actionable target.

Technical ContextAI

The affected component is a PHP-based patient authentication page (/patientlogin.php) in itsourcecode Hospital Management System 1.0, identified by CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied input in the loginid parameter is interpolated directly into backend SQL queries without parameterization or sufficient sanitization, allowing attackers to alter query logic. This is a classic prepared-statement failure common in PHP applications that construct queries via string concatenation. The wildcard version field in the CPE string indicates NVD has not bounded the affected range beyond version 1.0, and no upstream patch commit has been identified to anchor a fixed version.

RemediationAI

No vendor-released patch has been identified at time of analysis for itsourcecode Hospital Management System 1.0. The primary fix requires replacing string-concatenated SQL queries in /patientlogin.php with parameterized queries or prepared statements (e.g., PDO with bound parameters in PHP), which eliminates the injection root cause entirely. As interim compensating controls, administrators should deploy a web application firewall with SQL injection rulesets targeting the loginid parameter - note that WAF rules carry bypass risk and are not a permanent fix. Restricting public internet exposure of the login endpoint via IP allowlisting or VPN will reduce the network-accessible attack surface. Enabling database query logging can assist in detecting exploitation attempts. Monitor VulDB (https://vuldb.com/vuln/376306) and the vendor site (https://itsourcecode.com/) for any patch releases.