CVE-2026-76991: itsourcecode Hospital Management System viewappointmentapproved.php sql injection
A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation of the argument delid results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack is remotely exploitable over the network, but the CVSS vector indicates that the attacker requires low-level privileges. No user interaction is required.
Which component and input should be prioritized for review?
Review the /viewappointmentapproved.php endpoint, specifically its delid argument. Manipulation of this argument is reported to result in SQL injection.
Is there evidence that exploitation is practical?
Yes. Public exploit material is available, and the CVSS vector rates exploit maturity as proof-of-concept.
What impact could successful exploitation have?
The reported CVSS metrics indicate low impact to confidentiality, integrity, and availability. The scope is unchanged.