The vulnerability CVE-2026-13496 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the medicineid argument in an unknown function in the /ajaxmedicine.php file, leading to SQL injection. This allows an attacker to remotely execute arbitrary SQL commands on the backend database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. No official fix or patch has been published at this time.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands remotely, potentially leading to unauthorized data access or modification in the Hospital Management System database. The impact is rated medium based on CVSS 4.0 scoring, indicating limited but non-negligible risk to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint (/ajaxmedicine.php) and implement web application firewall rules to detect and block SQL injection attempts targeting the medicineid parameter.