The vulnerability identified as CVE-2026-13530 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection flaw in the Appointment Handler component, located in the /appointmentdetail.php file. The issue arises from improper sanitization or validation of the 'editid' parameter, allowing an attacker to inject malicious SQL queries remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor-provided patch or official remediation level documented at this time. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate the backend database queries, potentially leading to unauthorized data access, data modification, or other database-related impacts. Given the medium CVSS score and the availability of public exploits, there is a tangible risk to confidentiality and integrity of data managed by the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply web application firewalls or input validation controls to restrict or sanitize the 'editid' parameter. Monitor for unusual database activity related to the Appointment Handler component. Avoid exposing the vulnerable endpoint to untrusted networks if possible.