The vulnerability CVE-2026-14659 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection flaw located in an unspecified function within the /patientappointment.php file. The vulnerability arises from improper handling of the 'patiente' parameter, allowing an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported. There is no vendor advisory or patch available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries remotely. This may lead to unauthorized data access or modification within the Hospital Management System database. The CVSS vector indicates limited confidentiality, integrity, and availability impact, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint and monitor for unusual activity related to the 'patiente' parameter. Avoid exposing the vulnerable application to untrusted networks where possible.