Hospital Management System CVE-2026-19070

Q: What is the CVSS score of CVE-2026-19070?

CVE-2026-19070 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54246 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-06 cna@vuldb.com

GHSA-cp3j-5jxm-j2jh

PHP SQLi

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable SQLi requiring low-privilege auth (PR:L); full DB read/write yields C:H/I:H; limited availability impact (A:L) as DoS is not the primary concern.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewadmin.php endpoint to database manipulation via the unsanitized delid parameter. Authenticated low-privileged attackers with network access can craft malicious requests to read, modify, or delete records from the underlying database. A public exploit exists (POC confirmed via VulDB submission); no KEV listing at time of analysis.

Technical ContextAI

The affected application is a PHP-based hospital management system distributed by itsourcecode.com, version 1.0. The vulnerability is rooted in CWE-74 (Injection), specifically SQL injection arising from direct interpolation of the delid GET/POST parameter into a database query within /viewadmin.php without parameterized queries or adequate input sanitization. The delid name implies a delete-by-ID operation, a common SQLi target in PHP applications that use legacy mysql_* or raw PDO query concatenation patterns. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms the attack is remotely exploitable with low complexity and requires low privileges, consistent with a session-authenticated admin-panel endpoint exposed over HTTP/HTTPS.

RemediationAI

No vendor-released patch or patched version has been identified at time of analysis; no fixed version number is referenced in any provided source. The primary remediation is to replace raw SQL string concatenation in /viewadmin.php with parameterized queries or prepared statements using PDO or MySQLi in PHP. As compensating controls where patching is not immediately possible: restrict access to /viewadmin.php and the broader admin panel to trusted IP ranges via web server ACLs or firewall rules (reduces exposure but does not eliminate the flaw if admins work remotely); enable a Web Application Firewall (WAF) rule targeting SQL injection patterns on the delid parameter (may be bypassed by obfuscation); and audit database user privileges to ensure the application account has least-privilege access, limiting what an attacker can extract or modify via injection. Monitor VulDB entry https://vuldb.com/vuln/386539 for patch releases from the vendor at https://itsourcecode.com/.