The vulnerability CVE-2026-14774 affects itsourcecode Hospital Management System 1.0. It is an SQL injection flaw in an unspecified function within the /paymentdischarge.php file. Attackers can manipulate the patientid parameter to execute unauthorized SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating medium severity. No official remediation or patch has been disclosed by the vendor as of the publication date. Exploits have been publicly disclosed but no known active exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized data access or modification within the hospital management system database. The impact is limited by low attack complexity and low privileges required, but the vulnerability does not require user interaction. The overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the patientid parameter.