Is there a public PoC exploit available for EUVD-2026-40017?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40017. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System EUVD-2026-40017

Q: What is the CVSS score of EUVD-2026-40017?

EUVD-2026-40017 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13520 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-f7xw-hg8f-wrwg

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-exploitable SQL injection requiring low-privilege credentials (PR:L); no scope change and limited partial impact across C/I/A consistent with single-application database access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 02:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 01:42 vuln.today

DescriptionCVE.org

A vulnerability was determined in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /appointmentapproval.php of the component Appointment Handler. This manipulation of the argument editid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /appointmentapproval.php Appointment Handler endpoint to database manipulation via the editid parameter, allowing low-privileged remote attackers to read, modify, or delete backend data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-exploitability with minimal attack complexity once credentials are obtained, and a public proof-of-concept has been disclosed on GitHub, substantially lowering the attacker skill threshold. No active exploitation is confirmed by CISA KEV, but the medical context of the affected system - which likely stores sensitive patient and appointment records - amplifies the potential impact of even a limited SQL injection.

Technical ContextAI

The affected product is itsourcecode Hospital Management System 1.0, a PHP-based web application distributed via itsourcecode.com (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause as failure to sanitize or parameterize user-supplied input before it is incorporated into backend SQL queries. Specifically, the editid parameter within /appointmentapproval.php is passed directly into a database query without the use of prepared statements or input escaping. This is a classic PHP dynamic SQL concatenation anti-pattern, enabling an attacker to append arbitrary SQL clauses that the backend database engine will execute with the application's database permissions.

RemediationAI

No vendor-released patch has been identified at time of analysis for itsourcecode Hospital Management System 1.0. Developers should immediately remediate the root cause by replacing dynamic SQL string concatenation in /appointmentapproval.php with parameterized queries or prepared statements for the editid parameter, which eliminates the injection surface entirely without functional side effects. As an interim compensating control, deploy a web application firewall (WAF) rule to reject requests to /appointmentapproval.php containing SQL metacharacters (single quotes, comment sequences, UNION keywords) in the editid field - note that aggressive WAF rules may produce false positives on legitimate numeric appointment IDs. Additionally, restrict access to the appointment approval interface to trusted internal networks or VPN-only access, reducing the remote attack surface. Monitor itsourcecode.com and VulDB entry https://vuldb.com/vuln/374528 for patch availability. The public POC is documented at https://github.com/ltranquility/cve_submit/issues/20 and should be used to validate remediation effectiveness in a test environment.