CVE-2026-75086

This SQL injection in itsourcecode Hospital Management System (via the `delid` parameter in `/viewroom.php`) is not a one-off coding mistake — it is a symptom of a development pipeline with no security gates. Parameterized queries have been standard practice since the early 2000s; their absence here means no SAST scanning, no code review checklists, and no secure coding requirements were ever implemented. That institutional failure is the real vulnerability, not the single unsanitized parameter. The healthcare context makes this severe regardless of the CVSS 6.3 score. This system manages patient data, room allocations, and presumably billing tied to real identities. SQL injection here is a direct path to medical identity theft and HIPAA violations. More critically: a public exploit exists. The CVSS score reflects a snapshot before disclosure — the risk profile changed the moment the exploit went public. A medium-severity CVE with active weaponization is an active incident, not a backlog item. Assume this is not isolated. The same developer who left `delid` concatenated likely applied the same pattern to `patient_id`, `bill_id`, and every other foreign key reference in this codebase. Treat this CVE as a leading indicator of systematic compromise — audit every file handling user input, not just the one disclosed. Patching is necessary but insufficient. The vulnerable code persists in git history, uncommitted stashes, and forked repositories of this software that will never receive notification. The exposure window — the gap between public disclosure and when hospital operations allow patching — is where attackers operate freely. Your triage should prioritize compensating controls (WAF rules, query monitoring, network segmentation) while the patch lifecycle catches up. The broader question: healthcare institutions are deploying software from an unregulated vendor market with no security certification requirement. This CVE should force that conversation, not just the patch cycle.

Reviewed through automated stages and approved by a human before publication.