The vulnerability CVE-2026-13496 affects itsourcecode Hospital Management System 1.0. It is caused by improper handling of the medicineid argument in an unknown function of the /ajaxmedicine.php file, enabling an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official fix or vendor advisory is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely by manipulating the medicineid parameter. This may lead to unauthorized data access or modification within the Hospital Management System database. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, applying web application firewalls with SQL injection detection rules, and monitoring for suspicious activity targeting the medicineid parameter.