Hospital Management System Website CVE-2025-11319

Q: What is the CVSS score of CVE-2025-11319?

CVE-2025-11319 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-06 cna@vuldb.com

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:00 vuln.today

DescriptionCVE.org

A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some unknown processing of the file /delete.php. This manipulation of the argument ai causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in nahiduddinahammed Hospital-Management-System-Website allows authenticated remote attackers to execute arbitrary SQL queries via the ai parameter in /delete.php, with public exploit code available. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite network accessibility, as exploitation requires valid user authentication and produces only limited confidentiality impact. The vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability exists in /delete.php, a PHP endpoint that fails to properly sanitize user input in the ai parameter before constructing SQL queries, falling under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The application processes this parameter in unknown context without parameterized queries or input validation. The rolling-release deployment model means source code analysis must focus on the reported commit hash (e6562429e14b2f88bd2139cae16e87b965024097) rather than discrete versioned releases.

Affected ProductsAI

nahiduddinahammed Hospital-Management-System-Website up to commit e6562429e14b2f88bd2139cae16e87b965024097. The product uses continuous rolling releases without discrete version identifiers; no CPE strings are available. The GitHub repository is the canonical source for affected code state.

RemediationAI

Apply the upstream repository commit after the reported hash e6562429e14b2f88bd2139cae16e87b965024097 that implements parameterized queries or prepared statements for the ai parameter in /delete.php. Verify the fix by reviewing the SQL query construction in /delete.php to confirm dynamic string concatenation is replaced with parameterized query syntax (e.g., prepared statements with bound parameters). As interim control pending patch deployment, restrict /delete.php access via web application firewall to authenticated users only and implement SQL injection detection rules monitoring for UNION, SELECT, and comment syntax in the ai parameter. Contact the original reporter (cna@vuldb.com) via vuldb.com for patch confirmation, as vendor communication channels are unresponsive.