The vulnerability CVE-2026-14659 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection issue caused by improper handling of the 'patiente' argument in the /patientappointment.php file. The vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official fix or mitigation has been documented as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, indicating limited scope or difficulty in causing severe damage. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts may help reduce risk.