The vulnerability CVE-2026-14717 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the loginid parameter in an unknown function within /patientlogin.php, allowing an attacker to perform SQL injection. This can be exploited remotely without user interaction and with low attack complexity. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). No official fix or patch has been disclosed, and no vendor advisory is available to confirm remediation status.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries via the loginid parameter. This may lead to unauthorized data access or modification within the hospital management system database. The vulnerability is remotely exploitable without user interaction and has a low attack complexity, increasing the risk of exploitation. However, the CVSS vector indicates low confidentiality, integrity, and availability impact, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries for the loginid parameter in /patientlogin.php to mitigate SQL injection risks. Monitor for updates from the vendor or trusted security sources regarding patches or official mitigations.