The vulnerability CVE-2026-14731 affects itsourcecode Hospital Management System 1.0. It is an SQL injection flaw located in an unspecified part of the /patientreport.php file. Attackers can remotely exploit this by manipulating the 'editid' parameter, potentially allowing unauthorized database queries. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. No official fix or vendor advisory has been published to date.

Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands on the backend database remotely. This may lead to unauthorized data access or modification, though the impact on confidentiality, integrity, and availability is rated low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to the 'editid' parameter. Avoid exposing the vulnerable endpoint publicly if possible.