The vulnerability CVE-2026-13530 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the 'editid' argument in the /appointmentdetail.php file of the Appointment Handler component, enabling remote SQL injection attacks. This allows an attacker with low privileges to execute unauthorized SQL commands remotely without user interaction. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No vendor advisory or patch information is currently available, and public exploits exist.

Successful exploitation of this vulnerability could allow an attacker to manipulate SQL queries on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the low complexity of the attack. However, the exact scope of data exposure or modification is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected component and monitor for suspicious activity related to the 'editid' parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.