The vulnerability CVE-2026-14717 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the loginid parameter in an unknown function of the /patientlogin.php file, enabling an attacker to perform SQL injection attacks remotely. This could allow unauthorized access or manipulation of the backend database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official remediation or patch is currently documented.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without user interaction and requires no privileges, increasing its risk. However, the impact is rated medium due to limited complexity and scope as per the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the loginid parameter in /patientlogin.php. Additionally, review and harden input validation and parameter sanitization in the affected application code if possible.