Hospital Management System CVE-2026-19071

Q: What is the CVSS score of CVE-2026-19071?

CVE-2026-19071 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54253 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-06 cna@vuldb.com

GHSA-3x84-4p75-993j

PHP SQLi

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQLi requires low-privilege authentication (PR:L); all impacts bounded to Low with no scope change, consistent with the provided CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:31 vuln.today

DescriptionCVE.org

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint /viewappointment.php to database manipulation by authenticated low-privileged users via the delid parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.

Technical ContextAI

Hospital Management System 1.0 is a PHP-based web application distributed by itsourcecode, primarily used for educational and demonstration purposes. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), which is the parent class covering SQL injection. The root cause is unsanitized incorporation of the delid GET/POST parameter directly into a SQL query within /viewappointment.php, likely handling appointment deletion logic. The absence of parameterized queries or prepared statements allows an attacker to alter query structure. The application stack is PHP with a relational database backend (implied by SQL injection context). No CPE string was provided in the intelligence data; the affected product is identified solely as 'Hospital Management System 1.0' per EUVD-2026-54253.

RemediationAI

No vendor-released patch has been identified at time of analysis - no advisory from itsourcecode was found among the references, which point only to VulDB and GitHub issue trackers. The upstream fix, if any, has not been confirmed as a tagged release. As a compensating control, developers should immediately replace direct string concatenation in /viewappointment.php with parameterized queries or prepared statements for the delid parameter - this eliminates the injection point entirely. Restricting access to the appointment management interface to authenticated internal networks or VPNs reduces exposure. Deploying a web application firewall (WAF) rule targeting SQL metacharacter patterns in the delid parameter can provide short-term mitigation but should not substitute for code-level remediation. Input validation rejecting non-integer values for delid (since a deletion ID is expected to be numeric) is a minimal quick fix. References: https://github.com/ltranquility/submit_vuln/issues/16 (POC), https://vuldb.com/vuln/386540 (VulDB entry).