The vulnerability CVE-2026-10249 affects itsourcecode Online Blood Bank Management System 1.0. It is a SQL injection flaw located in the /admin/viewrequest.php file, specifically related to the ID parameter. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The vulnerability does not require privileges or user interaction to exploit. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. No vendor patch or official remediation is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Online Blood Bank Management System. This may lead to unauthorized data access, modification, or deletion. Given the nature of the application, sensitive blood bank data could be exposed or altered. The vulnerability is remotely exploitable without authentication, increasing the risk. However, the CVSS score and vector indicate the impact on confidentiality, integrity, and availability is low to limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor the vendor's communications for updates. As a temporary measure, restricting access to the /admin/viewrequest.php page to trusted IPs or implementing web application firewall (WAF) rules to detect and block SQL injection attempts may reduce risk. Avoid exposing the affected version publicly until a patch is available.