The vulnerability CVE-2026-78246 exists in itsourcecode Online Clinic Management System 1.0 within the Admin Login component's success/login.php file. The flaw arises from improper sanitization of the Username parameter, enabling an attacker to perform SQL injection remotely. This can lead to unauthorized database queries or data exposure. The exploit code is publicly available, increasing the risk of exploitation. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to manipulate backend database queries. This may lead to unauthorized data access, modification, or other database-related impacts depending on the database privileges of the affected application. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, indicating a significant but not critical risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Username parameter. Additionally, review and harden input validation and sanitization in the affected component if source code access is possible.