The vulnerability CVE-2026-19894 affects itsourcecode Hospital Management System version 1.0. It is an SQL injection flaw located in an unspecified function in the /viewmedicine.php file. By manipulating the 'delid' parameter, an attacker can inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code has been publicly disclosed, increasing the risk of exploitation. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely via the 'delid' parameter. This may lead to unauthorized data access or modification within the Hospital Management System. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and validate or sanitize input parameters to mitigate SQL injection risks.