Hospital Management System CVE-2026-19069

Q: What is the CVSS score of CVE-2026-19069?

CVE-2026-19069 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54240 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-06 cna@vuldb.com

GHSA-358j-c62v-fvw4

PHP SQLi

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

SQL injection enables full database read (C:H); PR:L reflects required authentication per CVSS 4.0 vector; no availability impact for read/modify SQLi.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:32 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-privilege credentials to manipulate database queries via the unsanitized editid parameter in /treatmentrecord.php. Exploitation can expose or alter sensitive patient treatment records stored in the backend database. A publicly disclosed exploit exists (E:P), though no confirmed active exploitation appears in CISA KEV at time of analysis.

Technical ContextAI

The application is a PHP-based hospital management platform (itsourcecode.com). CWE-74 (Injection) identifies the root cause as improper neutralization of special elements in the editid parameter passed to /treatmentrecord.php - consistent with the absence of parameterized queries or prepared statements. The parameter value is concatenated directly into a SQL statement, allowing an attacker to alter query logic. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the endpoint is network-reachable with no special attack preconditions beyond authentication, and no additional exploitation technique is required. Tags confirm the stack is PHP with a SQL-backed datastore.

RemediationAI

No vendor-released patch has been identified at time of analysis - patch status is unknown and should be monitored via VulDB entry 386538 (https://vuldb.com/vuln/386538) and the itsourcecode vendor site. The primary remediation is to refactor /treatmentrecord.php to use parameterized queries or prepared statements for all SQL operations involving the editid parameter, eliminating unsanitized input concatenation. As a compensating control, restrict access to the /treatmentrecord.php endpoint to internal networks or VPN-authenticated sessions only, preventing internet-exposed exploitation - note this does not eliminate insider or post-breach risk. Deploying a WAF with SQL injection signature rules (targeting UNION SELECT, OR-based payloads, comment sequences) can reduce opportunistic exploitation but is bypassable by custom payloads and should not substitute for a code-level fix. Input validation on the server side (allowlisting integer-only values for editid) is a lightweight mitigating measure if full parameterization is not immediately feasible.