The vulnerability CVE-2026-15536 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'delid' argument in the /patviewprescription.php file, which leads to SQL injection. This allows remote attackers to manipulate SQL queries executed by the application. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor as of the provided data.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the 'delid' parameter. This may lead to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to block malicious SQL injection attempts targeting the 'delid' parameter in /patviewprescription.php.