The vulnerability CVE-2026-13495 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the loginid argument in the /adminprofile.php file, allowing an attacker to perform SQL injection remotely. This can lead to unauthorized database queries or data exposure. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability allows an attacker with high privileges to execute arbitrary SQL commands on the backend database remotely. This can result in unauthorized data access, modification, or disruption of the application’s normal operation. The CVSS 4.0 base score is 5.1 (medium), reflecting the attack vector is network-based with low complexity and no user interaction required, but requiring high privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /adminprofile.php endpoint and validate or sanitize inputs at the application level to mitigate SQL injection risks.