Hospital Management System CVE-2026-75086

Exploitation requires a valid low-privilege authenticated session within the Hospital Management System application, as indicated by PR:L in the CVSS 4.0 vector. The attack targets the delid parameter in /viewroom.php specifically; no other special server-side configuration or non-default feature flag is required beyond a running, network-accessible instance of the application. Exploitation is constrained by the need for prior credential acquisition - unauthenticated external attackers cannot directly exploit this endpoint without first obtaining valid application login credentials, through phishing, credential stuffing, or default/weak password abuse. No victim user interaction is required once credentials are held, and attack complexity is low with no race condition or timing requirement.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) indicates a network-reachable, low-complexity SQLi requiring only low-privilege authentication, with partial impact across confidentiality, integrity, and availability and no scope change to subsequent systems. The E:P (proof-of-concept exists) supplemental metric is confirmed by a public GitHub exploit. No EPSS score was provided in the source data; exploitation probability must be inferred from signal combination rather than a numeric baseline. CISA KEV status is absent, so active mass exploitation is not confirmed. The 5.3 moderate score may understate real-world impact in deployments where the database user has elevated privileges - a common misconfiguration in development-oriented codebases like this one. Even a mid-sized municipal IT team in mielec running this application for inpatient records management should treat this as urgent given the public exploit, the healthcare data sensitivity, and the low barrier to exploitation once credentials are obtained. The limited scope metrics (SC:N/SI:N/SA:N) are credible only if database privilege separation is enforced.

An attacker with a low-privilege account in the Hospital Management System navigates to /viewroom.php and appends a crafted delid payload - such as a UNION-based injection - to extract staff credentials or patient records from the underlying database. A public proof-of-concept demonstrating this technique is available at https://github.com/11snk/CVE/issues/3, meaning the attack requires minimal SQLi expertise to reproduce against any internet-exposed instance.