Is there a public PoC exploit available for EUVD-2026-40113?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40113. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System EUVD-2026-40113

Q: What is the CVSS score of EUVD-2026-40113?

EUVD-2026-40113 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13572 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-hq9x-cf4j-9g74

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible injection requiring a low-privilege authenticated session; limited read/write impact on vulnerable system with no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:24 vuln.today

Severity Changed

Jun 29, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 15:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /insertbillingrecord.php. The manipulation of the argument patientid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the billing endpoint /insertbillingrecord.php to database manipulation by low-privileged remote attackers via the unsanitized patientid parameter. A public exploit has been disclosed on GitHub, lowering the barrier to exploitation significantly despite a low CVSS 4.0 base score of 2.1. No CISA KEV listing exists, but the combination of a publicly available proof-of-concept and access to potentially sensitive patient health and billing records elevates real-world concern beyond what the numeric score alone conveys.

Technical ContextAI

The affected application is a PHP-based hospital management web application distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) identifies the root cause as unsanitized user-controlled input being concatenated directly into SQL query strings rather than using parameterized queries or prepared statements. The specific injection point is the patientid parameter within /insertbillingrecord.php, a billing record insertion endpoint that likely queries patient data from a backend relational database. This is a textbook CWE-89 pattern in PHP applications that build dynamic SQL through string interpolation without escaping or binding parameters.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix is to refactor /insertbillingrecord.php to replace dynamic SQL string concatenation with parameterized queries or PHP PDO/MySQLi prepared statements, which eliminates the injection vector at the source. As an immediate compensating control, apply strict input validation on the patientid parameter to accept only numeric values, rejecting any non-integer input at the application layer before it reaches the query. Deploying a web application firewall (WAF) rule to detect and block SQL injection patterns (e.g., UNION, OR 1=1, comment sequences) targeting this endpoint can reduce exploitation risk but should not be treated as a permanent fix. Restrict access to the billing module to the minimum necessary authenticated roles and audit all other PHP endpoints in the application for similar unsanitized parameter handling. POC reference: https://github.com/ltranquility/vuln_submit/issues/20. VulDB advisory: https://vuldb.com/vuln/374580.