The vulnerability identified as CVE-2026-19364 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the 'delid' parameter in the /viewdoctorconsultancycharge.php file, enabling an attacker to inject SQL commands remotely. This could potentially allow unauthorized database queries or modifications. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or deletion within the Hospital Management System database. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability (low to limited impact).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality and monitor for suspicious activity related to the 'delid' parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.