Is there a public PoC exploit available for CVE-2026-15536?

Yes, a public proof-of-concept exploit is available for CVE-2026-15536. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-15536

Q: What is the CVSS score of CVE-2026-15536?

CVE-2026-15536 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43281 LOW

SQL Injection (CWE-89)

2026-07-13 VulDB

GHSA-j235-rw5q-p93g

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible PHP endpoint with low complexity; PR:L because authentication is required; S:U and limited C/I/A as impact is confined to the local database with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 07:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 06:46 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the argument delid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient prescription data to remote authenticated attackers via the delid parameter in /patviewprescription.php. Low-privilege access is sufficient to exploit this CWE-89 flaw, enabling database read, write, and partial disruption. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation beyond what the CVSS 4.0 score of 5.3 alone implies.

Technical ContextAI

The affected application is a PHP-based hospital management system distributed by itsourcecode, commonly used in academic or small-scale clinical deployments. The endpoint /patviewprescription.php passes user-supplied input from the delid parameter directly into a backend SQL query without sanitization or use of parameterized statements, constituting a textbook CWE-89 (Improper Neutralization of Special Elements used in SQL Command) flaw. The CPE string cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating no patched release has been catalogued. The underlying database is most likely MySQL, consistent with itsourcecode's typical PHP/MySQL stack.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor /patviewprescription.php to use parameterized queries or prepared statements for any database interaction involving the delid parameter, which is the only reliable remediation for CWE-89. As a compensating control, a web application firewall rule blocking SQL metacharacters (single quotes, comment sequences, UNION keywords) in the delid parameter can reduce exposure, though WAF rules are bypassable and must not substitute for code-level remediation. Access to the application should be restricted to trusted IP ranges if it is internet-exposed; if the system is not in active clinical use, taking it offline is recommended until a code fix is applied. VulDB report: https://vuldb.com/vuln/377886; vendor site: https://itsourcecode.com/.