The vulnerability CVE-2026-75086 affects itsourcecode Hospital Management System version 1.0. It is a SQL injection flaw caused by improper sanitization of the 'delid' argument in an unknown function within the /viewroom.php file. This allows remote attackers to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code has been disclosed, but no active exploitation has been reported. No vendor advisory or patch information is available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Hospital Management System, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score of 5.3. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the 'delid' parameter.