Hospital Management System CVE-2026-19894

The attacker must possess a valid low-privileged account on the Hospital Management System (CVSS PR:L confirmed). The vulnerable injection point is the delid GET or POST parameter in the /viewmedicine.php file, which requires no special non-default configuration - any standard installation of version 1.0 is affected. Exploitation is constrained by the authentication requirement: unauthenticated attackers cannot directly target the parameter without first obtaining credentials via other means such as credential stuffing, phishing, or default credential use. The attack is fully network-reachable (AV:N) with no user interaction required (UI:N) once authenticated. No specific feature flag, database mode, or deployment variant is required beyond a running instance of version 1.0.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) with E:P (PoC exists) and a score of 5.3 reflects network reachability with low-privilege authentication required and partial impact across confidentiality, integrity, and availability. However, the vendor-assigned impact ratings (VC:L/VI:L/VA:L) appear conservative for a SQL injection flaw, which typically enables full database read and write access - real-world impact is likely higher than the base score suggests. There is no CISA KEV listing, meaning active exploitation has not been formally confirmed, though a public PoC lowers the exploitation threshold considerably. EPSS data was not provided in source intelligence, leaving probabilistic exploitation frequency unquantified. The PR:L requirement (valid account needed) is the primary limiting factor; even a mid-sized municipal IT team in inowroclaw deploying this system internally for administrative use would face meaningful risk if staff accounts are broadly provisioned. Because healthcare data carries regulatory and privacy weight, the real-world business impact of a successful exploitation exceeds what the numeric CVSS score alone communicates.

An attacker with a low-privileged account - such as a receptionist, data-entry staff member, or any user with valid credentials - sends a crafted HTTP request to /viewmedicine.php?delid=1 UNION SELECT ... using the publicly available proof-of-concept hosted on GitHub. The unsanitized parameter is passed directly to the database, allowing the attacker to enumerate all tables and extract the full database contents, including patient records, user credentials, and administrative data, within minutes.