Is there a public PoC exploit available for CVE-2026-16244?

Yes, a public proof-of-concept exploit is available for CVE-2026-16244. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-16244

Q: What is the CVSS score of CVE-2026-16244?

CVE-2026-16244 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45940 LOW

SQL Injection (CWE-89)

2026-07-20 VulDB

GHSA-ch3w-v2fc-7xmj

PHP SQLi Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requiring low-privilege auth; unchanged scope and partial CIA impact consistent with application-layer query manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 20, 2026 - 13:23 NVD

MEDIUM LOW

CVSS changed

Jul 20, 2026 - 13:23 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 20, 2026 - 13:22 vuln.today

CVE Published

Jul 20, 2026 - 12:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /prescriptionorderreport.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.

Technical ContextAI

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected product is a PHP-based hospital management application distributed by itsourcecode.com, a provider of educational and demonstration web projects. The delid parameter in /prescriptionorderreport.php - likely used to identify a prescription order record for deletion or reporting - is passed directly into a database query without parameterization or sanitization, a classic unsanitized input flaw in PHP/MySQL stacks. The CPE string cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not scoped the vulnerability to a specific release range beyond the reported 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis for this educational codebase. The primary remediation is to apply parameterized queries or PDO prepared statements in /prescriptionorderreport.php to neutralize the delid injection vector - developers should replace any direct string concatenation into SQL with bound parameters. As a compensating control, restrict access to /prescriptionorderreport.php via web server configuration (e.g., IP allowlisting or HTTP authentication at the server level) to limit exposure to trusted users; note this does not eliminate the underlying flaw. Deploying a web application firewall rule to block SQL metacharacters (single quotes, UNION, SELECT keywords) in the delid parameter can reduce opportunistic exploitation, though WAF rules can be bypassed and should not substitute for code-level fixes. Reference the VulDB entry at https://vuldb.com/vuln/380535 and the POC at https://github.com/ltranquility/submit_vuln/issues/10 for reproduction details to validate any fix.