The vulnerability CVE-2026-19972 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the 'delid' parameter in the /viewpatient.php file, leading to SQL injection. This allows an attacker with low privileges to remotely execute unauthorized SQL commands with low complexity and no user interaction. The vulnerability has been publicly disclosed, but no official fix or patch has been published by the vendor as of the data provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate the backend database queries, potentially leading to unauthorized data access, modification, or deletion. The attack can be performed remotely without user interaction and requires low privileges. The overall impact is rated medium based on the CVSS 5.3 score and vector, indicating limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts may help mitigate risk.