The vulnerability CVE-2026-14774 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection flaw in the /paymentdischarge.php file caused by improper sanitization of the patientid parameter. This allows an attacker with low privileges to remotely execute SQL injection attacks, potentially impacting confidentiality, integrity, and availability of the system. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and low to low impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided by the vendor or authoritative sources.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the patientid parameter. This may lead to unauthorized data access, modification, or deletion affecting the hospital management system's data integrity and confidentiality. The impact is rated as medium severity based on the CVSS score of 5.3. There are no reports of active exploitation in the wild.

No official patch or remediation guidance is currently available from the vendor or authoritative sources. Users of itsourcecode Hospital Management System version 1.0 should monitor vendor advisories for updates. Until a fix is released, consider restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the patientid parameter.