The vulnerability CVE-2026-13542 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the doctorname argument in the /doctorprofile.php file, allowing remote attackers to inject SQL commands. This can lead to unauthorized database queries or data manipulation. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized SQL queries on the backend database, potentially leading to data disclosure, modification, or other impacts depending on the database privileges. The impact is limited by the low confidentiality, integrity, and availability metrics in the CVSS vector. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the doctorname parameter. Input validation and parameterized queries should be applied if possible as a temporary mitigation.