The vulnerability CVE-2026-13520 affects itsourcecode Hospital Management System 1.0. It is a SQL injection issue caused by improper handling of the 'editid' parameter in the /appointmentapproval.php file within the Appointment Handler component. This allows an attacker to remotely manipulate SQL queries by injecting malicious input. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected component and monitor for suspicious activity related to the 'editid' parameter. No vendor-provided mitigation or temporary fix is currently documented.