The vulnerability CVE-2026-14619 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the 'editid' parameter in the /medicine.php file, which leads to SQL injection. This allows an attacker with low privileges to remotely execute unauthorized SQL commands. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. Since the attack requires low privileges and no user interaction, it poses a moderate risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'editid' parameter in /medicine.php to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database user permissions may also help reduce impact.