Is there a public PoC exploit available for CVE-2026-16131?

Yes, a public proof-of-concept exploit is available for CVE-2026-16131. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-16131

Q: What is the CVSS score of CVE-2026-16131?

CVE-2026-16131 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45392 LOW

SQL Injection (CWE-89)

2026-07-18 VulDB

SQLi PHP Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible PHP endpoint requires authenticated low-privilege session (PR:L); delete-parameter injection enables data read, manipulation, and potential record deletion (C:L/I:L/A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 18, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Jul 18, 2026 - 19:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 18, 2026 - 18:51 vuln.today

CVE Published

Jul 18, 2026 - 18:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the delid parameter in /prescriptionrecord.php. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.

Technical ContextAI

The vulnerability is a CWE-89 (Improper Neutralization of Special Elements in SQL Commands) in a PHP-based hospital management application distributed by itsourcecode. The delid parameter - likely intended for record deletion by ID - is passed to /prescriptionrecord.php without adequate sanitization or parameterization, allowing an attacker to inject arbitrary SQL into the backend database query. CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:* covers all known versions, suggesting no release has addressed this class of flaw. itsourcecode distributes open-source PHP management scripts commonly used in academic institutions, clinics, and student projects, where security hardening is frequently minimal.

RemediationAI

No vendor-released patch has been identified at time of analysis. The immediate mitigation is to audit and rewrite the SQL query in /prescriptionrecord.php to use parameterized prepared statements (PDO or MySQLi with bound parameters), eliminating the injection surface entirely. As a compensating control, operators should deploy a web application firewall rule to block SQL metacharacters in the delid parameter - though WAF bypass is possible and this is not a substitute for code-level fixes. Access to /prescriptionrecord.php should be restricted via web server ACLs to the minimum required user roles. Additionally, applying principle of least privilege to the database account used by the application will limit the blast radius of any successful injection. Monitor VulDB advisory https://vuldb.com/vuln/379850 for patch availability updates.