The vulnerability CVE-2026-13497 affects itsourcecode Hospital Management System version 1.0. It is a SQL injection issue caused by improper sanitization of the 'editid' argument in an unknown function within the /appointment.php file. This allows an attacker to inject malicious SQL commands remotely, potentially compromising the database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating it requires low attack complexity and no user interaction, but limited impact on confidentiality, integrity, and availability. No official remediation or patch is currently available according to the vendor data.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact is rated as limited in terms of confidentiality, integrity, and availability based on the CVSS vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published, users should apply standard SQL injection mitigations such as input validation and parameterized queries if possible. Monitor vendor channels for updates and apply any official patches once available.