The vulnerability CVE-2026-11514 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'admissiontme' argument in the /addpatient.php file, leading to SQL injection. This allows an attacker to remotely manipulate database queries, potentially compromising data integrity or confidentiality. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No vendor patch or official remediation is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification within the hospital management system. However, the impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall rules to detect and block malicious SQL injection attempts targeting the 'admissiontme' parameter. Monitor for updates from itsourcecode regarding patches or official mitigations.