The vulnerability CVE-2026-13548 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection issue caused by improper validation of the 'editid' parameter in the /doctortimings.php script. This allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the 'editid' parameter. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the database privileges of the application. The impact is rated medium based on the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'editid' parameter to prevent SQL injection. Restrict database permissions for the application to minimize potential damage. Monitor for updates from the vendor regarding patches or official mitigations.