The vulnerability identified as CVE-2026-75088 affects itsourcecode Hospital Management System version 1.0. It involves an SQL injection flaw in the /viewbilling.php file, specifically through the delid parameter. This allows an attacker to remotely execute unauthorized SQL commands by manipulating this argument. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with low privileges to remotely execute SQL injection attacks, potentially leading to unauthorized data access or modification within the Hospital Management System database. The CVSS vector indicates low complexity and no user interaction required, but the overall impact is limited by low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint and monitor for suspicious activity related to the delid parameter. No official patch or workaround is currently documented.