Is there a public PoC exploit available for EUVD-2026-47594?

Yes, a public proof-of-concept exploit is available for EUVD-2026-47594. Prioritise patching immediately. EPSS: 0.2%.

Hospital Management System EUVD-2026-47594

Q: What is the CVSS score of EUVD-2026-47594?

EUVD-2026-47594 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-16490 LOW

SQL Injection (CWE-89)

2026-07-22 VulDB

GHSA-p58h-q4wh-jxrq

PHP SQLi Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network vector confirmed by description; PR:L consistent with CVSS 4.0 input; low impact across CIA defers to reporter's constrained-scope assessment.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:55 vuln.today

Severity Changed

Jul 22, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

Jul 22, 2026 - 01:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 22, 2026 - 00:15 cve.org

LOW 2.1

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /prescription.php endpoint to database manipulation via the unsanitized editid parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from unsanitized user input being concatenated directly into a SQL query in the PHP script /prescription.php. The affected product is identified by CPE cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*, with version 1.0 explicitly confirmed by EUVD (EUVD-2026-47594). The itsourcecode platform is a code-sharing and tutorial site, and this system is a PHP-based demo/educational healthcare application rather than a commercial product, which significantly constrains its real-world deployment footprint. Parameterized queries or prepared statements are absent for the editid parameter handling.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fix version appears in any referenced advisory or VulDB entry. As a compensating control, operators should implement WAF rules to detect and block SQL metacharacters and common injection patterns in the editid parameter of requests to /prescription.php, noting that WAF bypass techniques exist and this is not a permanent fix. The application's database account should be scoped to the minimum necessary privileges (read-only SELECT where applicable) to limit the blast radius of a successful injection. If the system is internet-exposed, restricting /prescription.php access to authenticated internal IP ranges or placing the application behind a VPN would substantially reduce attack surface. Given this is an educational/demo codebase, organizations running it in any production capacity should assess whether a purpose-built, commercially supported alternative is more appropriate. Monitor https://vuldb.com/vuln/380947 and https://nvd.nist.gov/vuln/detail/CVE-2026-16490 for patch releases.