The vulnerability CVE-2026-13548 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection flaw in an unspecified function within the /doctortimings.php file. The attack vector is the 'editid' parameter, which can be manipulated remotely to execute unauthorized SQL commands. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. No vendor-provided patch or official remediation is available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or deletion within the Hospital Management System database. The impact is limited by the low privileges required and the lack of confirmed exploit activity in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the 'editid' parameter in /doctortimings.php to mitigate SQL injection risks.