Is there a public PoC exploit available for EUVD-2026-39993?

Yes, a public proof-of-concept exploit is available for EUVD-2026-39993. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System EUVD-2026-39993

Q: What is the CVSS score of EUVD-2026-39993?

EUVD-2026-39993 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13495 LOW

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-wxx9-qqpf-884g

PHP SQLi Hospital Management System Itsourcecode

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Admin authentication required (PR:H) to reach the vulnerable endpoint; network-accessible but no scope change and only limited database impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 28, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 28, 2026 - 13:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jun 28, 2026 - 13:16 vuln.today

DescriptionCVE.org

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminprofile.php. The manipulation of the argument loginid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated administrators to database manipulation via the loginid parameter in /adminprofile.php. The CVSS 4.0 vector (PR:H) confirms exploitation is constrained to authenticated high-privilege sessions, limiting mass exploitation risk despite network accessibility. A public proof-of-concept exploit has been disclosed on GitHub, lowering the technical barrier for targeted abuse by insiders or credential-compromised actors.

Technical ContextAI

The affected product is itsourcecode Hospital Management System 1.0, a PHP-based web application identified via CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic failure to sanitize or parameterize user-controlled input before interpolation into SQL queries. Specifically, the loginid parameter in the /adminprofile.php endpoint is passed unsanitized to the database layer, enabling SQL query manipulation. This pattern is common in small PHP applications that use direct string concatenation for database queries rather than prepared statements or ORM abstraction layers.

RemediationAI

No vendor-released patch has been identified at time of analysis; remediation status is unknown based on available input data. For organizations running this application, the primary fix requires modifying the PHP source code to replace direct SQL string concatenation with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi prepared statements) for the loginid parameter in /adminprofile.php. As compensating controls, restrict network access to /adminprofile.php at the web server or firewall level so only trusted administrative IP ranges can reach the admin interface - this directly reduces the attack surface given the PR:H requirement. Deploying a Web Application Firewall (WAF) with SQL injection detection rules can block exploit attempts at the perimeter, though WAFs can be bypassed by determined attackers. Enforcing strong, unique administrator passwords and multi-factor authentication reduces the risk of credential compromise that would enable this attack. See VulDB advisory at https://vuldb.com/vuln/374490 for additional context.