kishan0725 Hospital Management System version 4 contains a SQL Injection vulnerability in the admin-panel1.php file, specifically in the logic that deletes doctor records. The vulnerability arises because the application does not properly sanitize or parameterize the 'demail' parameter before using it in a dynamic SQL query. This flaw allows an unauthenticated attacker to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.