Is there a public PoC exploit available for CVE-2026-16009?

Yes, a public proof-of-concept exploit is available for CVE-2026-16009. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-16009

Q: What is the CVSS score of CVE-2026-16009?

CVE-2026-16009 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45162 LOW

SQL Injection (CWE-89)

2026-07-17 VulDB

GHSA-cvrq-x8r7-pgc9

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requires low-privilege auth (PR:L); scope unchanged as impact stays within the application database; all impacts capped at Low given bounded query manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 17, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jul 17, 2026 - 12:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 17, 2026 - 12:01 vuln.today

CVE Published

Jul 17, 2026 - 11:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The manipulation of the argument delid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the delid parameter of /prescriptionorderdetail.php. An authenticated low-privilege user can extract, alter, or delete sensitive patient and prescription records stored in the backend database. A public exploit proof-of-concept is available on GitHub (E:P per CVSS 4.0), lowering the barrier to exploitation; however, no CISA KEV listing has been identified, and the overall impact is bounded to low-level confidentiality, integrity, and availability effects.

Technical ContextAI

The affected component is a PHP-based hospital management web application distributed by itsourcecode, identified by CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the delid parameter passed to /prescriptionorderdetail.php is interpolated directly into a SQL query without parameterization or escaping. This is a textbook unsanitized user-input pattern common in educational PHP codebases that rely on procedural MySQL query construction rather than PDO or MySQLi prepared statements. The wildcard CPE version field suggests the flaw may apply to all released versions, with version 1.0 specifically named in the disclosure.

RemediationAI

No vendor-released patch has been identified at time of analysis. Because itsourcecode Hospital Management System is distributed as open-source PHP source code, the primary fix is a direct code change: replace string-concatenated SQL queries in /prescriptionorderdetail.php that incorporate the delid parameter with parameterized prepared statements using PHP's PDO or MySQLi extensions, which eliminate injection by separating SQL structure from user-supplied data. As a compensating control, restrict access to the prescription order detail page via application-level role enforcement so that only trusted administrative roles can invoke the delid functionality, reducing the attacker pool. Additionally, deploying a web application firewall (WAF) rule to detect and block common SQL metacharacter patterns (', --, UNION, OR 1=1) in the delid parameter can provide a defensive layer while code changes are applied. The public exploit is documented at https://github.com/ltranquility/submit_vuln/issues/8 and the VulDB advisory is at https://vuldb.com/vuln/379753.