Is there a public PoC exploit available for CVE-2026-16334?

Yes, a public proof-of-concept exploit is available for CVE-2026-16334. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System CVE-2026-16334

Q: What is the CVSS score of CVE-2026-16334?

CVE-2026-16334 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46146 LOW

SQL Injection (CWE-89)

2026-07-21 VulDB

GHSA-2rpx-m23v-x3h4

PHP SQLi Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint but PR:L required; unchanged scope and limited CIA impact match CVSS 4.0 VC:L/VI:L/VA:L/SC:N/SI:N/SA:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 21, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 21, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 21, 2026 - 02:46 vuln.today

CVE Published

Jul 21, 2026 - 02:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the editid parameter in /prescriptionorder.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

The affected product is a PHP-based web application - itsourcecode Hospital Management System version 1.0 - catalogued under CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection arising from unsanitized user input being concatenated directly into a database query. The vulnerable parameter is editid in the /prescriptionorder.php endpoint. PHP applications of this pattern typically construct SQL queries via string interpolation without prepared statements or parameterized queries, allowing an attacker to inject arbitrary SQL syntax through GET or POST parameters.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace string-concatenated SQL queries in /prescriptionorder.php with PHP prepared statements using PDO or MySQLi bound parameters, which eliminates the injection surface for editid and any other unsanitized parameters. As a compensating control, deploy a web application firewall (WAF) rule to detect and block SQL metacharacter patterns in the editid parameter - note this can be bypassed by encoding evasion and is not a substitute for code fixes. Additionally, restrict access to the prescription order endpoint to the minimum required roles and enforce strong session management to reduce the window of a compromised low-privilege account. For organizations unable to patch immediately, audit database user privileges to ensure the application DB user has only SELECT/INSERT/UPDATE rights on needed tables and cannot access system tables or execute stacked queries. Advisory references: https://vuldb.com/vuln/380703 and https://vuldb.com/cve/CVE-2026-16334.