Is there a public PoC exploit available for EUVD-2026-41703?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41703. Prioritise patching immediately. EPSS: 0.3%.

Hospital Management System EUVD-2026-41703

Q: What is the CVSS score of EUVD-2026-41703?

EUVD-2026-41703 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-14659 LOW

SQL Injection (CWE-89)

2026-07-04 VulDB

GHSA-rwq5-837x-pc75

PHP SQLi Hospital Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection requiring low-privilege auth (PR:L); unchanged scope with low CIA impact consistent with partial data read/write on a single application instance.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 04, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 04, 2026 - 22:51 vuln.today

DescriptionCVE.org

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /patientappointment.php. Such manipulation of the argument patiente leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and appointment data to remote attackers holding low-privilege credentials via the patiente parameter in /patientappointment.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation with no attack complexity, and the E:P modifier reflects a publicly disclosed proof-of-concept on GitHub. While not yet listed in CISA KEV, the combination of a live PoC, a healthcare data context, and trivial exploitation conditions makes this a credible risk for any organization running this application.

Technical ContextAI

The affected product is a PHP-based Hospital Management System (version 1.0) published by itsourcecode, a code-sample and educational resource site, identified by CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the patiente GET or POST parameter passed to /patientappointment.php is incorporated directly into a backend SQL query without sanitization or use of parameterized statements. This is a classic PHP + MySQL anti-pattern where string concatenation builds queries, allowing an attacker to append or alter SQL logic. Because the wildcard appears in the CPE version field, no formally declared patch boundary exists in NVD data.

RemediationAI

No vendor-released patch has been identified at time of analysis. As an immediate compensating control, restrict access to /patientappointment.php via a web application firewall (WAF) rule that blocks SQL metacharacter injection patterns - specifically single quotes, UNION, SELECT, and comment sequences (-- and #) - in the patiente parameter; note this may generate false positives on legitimate patient name inputs containing apostrophes and should be tuned carefully. If the application is not required to be internet-facing, place it behind a VPN or restrict it to trusted internal IP ranges, significantly reducing the attack surface despite the AV:N vector. For a permanent fix, developers should refactor the /patientappointment.php query to use PHP PDO or MySQLi prepared statements with bound parameters, eliminating the CWE-89 root cause entirely. The public PoC at https://github.com/ltranquility/vuln_submit/issues/21 details the exact injection point and should be used to verify remediation effectiveness after code changes. Reference the VulDB entry at https://vuldb.com/vuln/376173 for additional technical context.