Is there a public PoC exploit available for CVE-2025-3096?

Yes, a public proof-of-concept exploit is available for CVE-2025-3096. Prioritise patching immediately. EPSS: 62.6%.

How to fix or mitigate CVE-2025-3096?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

CVE-2025-3096

Q: What is the CVSS score of CVE-2025-3096?

CVE-2025-3096 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 62.6%.

CRITICAL

SQL Injection (CWE-89)

2025-04-01 cve@rapid7.com

SQLi

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:34 vuln.today

CVE Published

Apr 01, 2025 - 19:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.

AnalysisAI

Clinic's Patient Management System version 2.0 contains a SQL injection vulnerability in the login page. Unauthenticated attackers can bypass authentication and extract the entire patient database including medical records, personal information, and appointment histories through SQL injection in login credentials.

Technical ContextAI

The login page processes username and password fields without parameterized queries or input sanitization. An attacker can inject SQL in the login fields to bypass authentication (e.g., admin' OR '1'='1) or extract database contents through UNION-based or time-based blind injection techniques.

Affected ProductsAI

Clinic's Patient Management System 2.0

RemediationAI

Update the system to use parameterized queries. Deploy a WAF with SQL injection detection. Conduct a PHI breach assessment if exploitation is suspected. Implement multi-factor authentication for clinical systems. Consider migrating to a certified EHR system.

CVE-2025-3096 vulnerability details – vuln.today

Back