The vulnerability CVE-2026-75087 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'delid' argument in the /viewdepartment.php script, enabling an attacker to inject SQL commands remotely. This can lead to unauthorized database queries or modifications. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although exploit code is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation allows remote attackers to perform SQL injection via the 'delid' parameter, potentially leading to unauthorized access or modification of the database. The impact is rated medium with limited privileges required and no user interaction needed. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the vulnerable endpoint and implement web application firewall rules to detect and block SQL injection attempts targeting the 'delid' parameter.