The vulnerability CVE-2026-76991 exists in itsourcecode Hospital Management System 1.0 within the /viewappointmentapproved.php file. An attacker can manipulate the 'delid' argument to inject SQL commands, potentially compromising the database. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. Although exploit code is publicly available, there is no vendor-provided fix or mitigation at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint and monitor for suspicious activity related to the 'delid' parameter. No vendor-provided mitigation or temporary fix is currently documented.