The vulnerability CVE-2026-13497 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'editid' parameter in the /appointment.php file, leading to SQL injection. This allows an attacker to manipulate SQL queries remotely, potentially compromising the database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating that it requires low attack complexity and no user interaction but has limited impact on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor as of the information provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact is rated medium with limited confidentiality, integrity, and availability impact according to the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL injection via the 'editid' parameter. Monitor vendor communications for updates on patches or official remediation.