The vulnerability CVE-2026-13532 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the deptid parameter in the /departmentDoctor.php file, allowing an attacker to perform SQL injection. This can be exploited remotely with low attack complexity and no user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. There is no vendor-provided patch or official remediation level at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack requires low privileges and no user interaction, increasing the risk of remote exploitation. However, the overall impact is rated medium due to limited details on the extent of data exposure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the deptid parameter to mitigate SQL injection risks. Monitor for any updates from the vendor regarding patches or official mitigations.