The vulnerability CVE-2026-16244 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the 'delid' parameter in the /prescriptionorderreport.php file, allowing an attacker to perform SQL injection. This can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by the vendor.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands on the backend database via the 'delid' parameter. This can lead to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, indicating limited potential damage. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'delid' parameter.