Is there a public PoC exploit available for EUVD-2026-39995?

Yes, a public proof-of-concept exploit is available for EUVD-2026-39995. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System EUVD-2026-39995

Q: What is the CVSS score of EUVD-2026-39995?

EUVD-2026-39995 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13497 LOW

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-72rc-cg52-95m2

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requiring low-privilege auth (PR:L); SQLi yields limited data read/write but no full system compromise or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 13:30 vuln.today

Severity Changed

Jun 28, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 28, 2026 - 13:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /appointment.php. This manipulation of the argument editid causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment management endpoint to remote database manipulation via the unsanitized editid parameter in /appointment.php. Authenticated low-privileged users can craft malicious SQL payloads to read, modify, or corrupt appointment and patient records in the underlying database. A publicly available proof-of-concept exploit exists (GitHub issue linked in references); no CISA KEV listing at time of analysis.

Technical ContextAI

The affected product is a PHP-based hospital management web application distributed by itsourcecode.com, primarily as a student or small-clinic reference implementation. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the application directly interpolates user-supplied input into SQL queries without parameterized queries or adequate sanitization. The affected endpoint is /appointment.php, which processes an editid GET or POST parameter to retrieve or update appointment records. CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:* covers all tracked versions with no lower bound exclusion, suggesting the flaw is present across the entire version lineage.

RemediationAI

No vendor-released patched version has been identified at time of analysis. The itsourcecode.com vendor page (https://itsourcecode.com/) should be monitored for updates. As an immediate compensating control, developers should replace direct SQL string concatenation in /appointment.php with PHP PDO or MySQLi prepared statements with bound parameters for the editid input - this eliminates the injection surface entirely. Access to the affected application should be restricted to trusted internal networks or VPN, limiting the attack surface to authenticated internal users only, though note this does not eliminate risk from insider or compromised-account scenarios. Input validation should enforce that editid accepts only integer values and reject any non-numeric input with a 400 error. Given the healthcare data context, a database audit should be performed to check for unauthorized access or data modification consistent with SQLi exploitation.