The vulnerability CVE-2026-75087 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'delid' parameter in the /viewdepartment.php file, allowing an attacker to inject SQL commands remotely. This could potentially lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploit code is available, but no evidence of active exploitation has been documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited privileges required and partial impact on confidentiality, integrity, and availability.

No official patch or vendor advisory is currently available for this vulnerability. Organizations using itsourcecode Hospital Management System 1.0 should monitor vendor communications for updates. In the meantime, restricting access to the affected endpoint and employing web application firewalls to detect and block SQL injection attempts may reduce risk.