CVE-2026-19347 is a SQL injection vulnerability in itsourcecode Hospital Management System 1.0 affecting the /viewdoctor.php endpoint. The issue arises from improper processing of the delid parameter, which can be manipulated remotely to inject SQL commands. This vulnerability requires low privileges and no user interaction to exploit. The CVSS 3.1 base score is 6.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized access or modification of data and partial disruption of service. The impact is rated low to medium based on the CVSS score and described effects on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and validate and sanitize all input parameters, especially delid, to mitigate SQL injection risks.