The vulnerability CVE-2026-77025 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'delid' argument in the /viewappointmentpending.php script, enabling an attacker to inject SQL commands remotely. This can lead to unauthorized database queries or modifications. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit code exists, but no vendor-provided fix or mitigation has been documented yet.

Successful exploitation allows remote attackers to perform SQL injection attacks on the hospital management system's database via the 'delid' parameter. This could lead to unauthorized data access, modification, or deletion depending on the database privileges of the application. The presence of public exploit code increases the risk of attack, although no active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and monitor for suspicious activity related to the 'delid' parameter. Avoid exposing the vulnerable interface to untrusted networks if possible.