The vulnerability CVE-2026-19347 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization or validation of the 'delid' argument in the /viewdoctor.php script, leading to SQL injection. This allows an attacker to manipulate SQL queries remotely without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch information is currently available, and the exploit is publicly accessible.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack can be performed remotely without user interaction and requires low privileges. However, the overall impact is rated medium due to limited details on the extent of database access or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the 'delid' parameter and consider applying web application firewalls or other filtering mechanisms to detect and block SQL injection attempts.