The itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in an unspecified function of the /viewroom.php file. The vulnerability arises from improper sanitization of the delid parameter, allowing an attacker to inject SQL commands remotely. The vulnerability is tracked as CVE-2026-75086 and has a CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Exploit code has been publicly disclosed, but there are no known exploits currently observed in the wild. No patch or remediation information is provided.

Successful exploitation could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to limited confidentiality, integrity, and availability impacts on the affected system. The impact is rated as low by the database, but the CVSS score suggests a medium severity due to the ability to remotely exploit and cause partial compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected endpoint and validate or sanitize input parameters to mitigate SQL injection risks.