Is there a public PoC exploit available for EUVD-2026-40028?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40028. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System EUVD-2026-40028

Q: What is the CVSS score of EUVD-2026-40028?

EUVD-2026-40028 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13531 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-2223-xwm4-7m5g

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable (AV:N), low complexity (AC:L), low-privilege auth required (PR:L), no user interaction; SQL injection yields partial database read/write/delete with low C/I/A in unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 04:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 04:02 vuln.today

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /department.php. The manipulation of the argument editid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /department.php endpoint to database manipulation via the unsanitized editid parameter, allowing a remote low-privileged authenticated attacker to read, modify, or delete hospital database contents. The CVSS 4.0 vector (PR:L) confirms a valid user account is required, constraining but not eliminating risk for internet-exposed instances. A public exploit has been released on GitHub, materially increasing the likelihood of opportunistic abuse against deployed instances.

Technical ContextAI

This is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in a PHP-based hospital management web application authored by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). The /department.php script accepts an editid GET or POST parameter and passes it directly into a backend SQL query without parameterization or escaping, a textbook unsanitized input vulnerability. itsourcecode publishes demo/tutorial PHP projects for developers at itsourcecode.com; this system is a PHP/MySQL stack with no indication of a prepared-statement pattern in the affected endpoint.

RemediationAI

No vendor-released patch has been identified at time of analysis; the itsourcecode project does not appear to have issued a formal security advisory or updated release. The primary remediation is to replace direct string interpolation in the editid SQL query within /department.php with parameterized queries or prepared statements using PDO or MySQLi. As a compensating control, deploy a Web Application Firewall (WAF) rule to block SQL metacharacter patterns (quotes, UNION, SELECT, --, etc.) in the editid parameter - note this may break legitimate department ID inputs if not carefully scoped. Additionally, restrict access to the application to trusted internal networks only, removing internet exposure where operationally feasible. Reference: https://vuldb.com/vuln/374539.