Skip to main content

Hospital Management System EUVDEUVD-2025-20467

| CVE-2025-7176 MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2025-07-08 cna@vuldb.com
PHP SQLi Hospital Management System Phpgurukul
5.5
CVSS 4.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-74
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

SQL injection in PHPGurukul Hospital Management System 1.0 allows remote attackers to manipulate the viewid parameter in view-medhistory.php, leading to unauthorized database access. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation. No vendor patch has been confirmed at this time.

Affected VersionsENISA

Hospital Management System 1.0

Affected Packages

euvd hospital_management_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Hospital Management System gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
Low
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

5
Severity Changed
Apr 29, 2026 - 01:11 NVD
HIGH MEDIUM
CVSS changed
Apr 29, 2026 - 01:11 NVD
7.3 (HIGH) 5.5 (MEDIUM)
PoC Detected
Jul 08, 2025 - 19:19 vuln.today
Public exploit code
CVE Published
Jul 08, 2025 - 12:15 nvd
HIGH 7.3
CVE Published
Jul 08, 2025 - 12:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file view-medhistory.php. The manipulation of the argument viewid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

More in Hospital Management System

View all
CVE-2023-43958 CRITICAL POC
9.8 Apr 22

An arbitrary file upload vulnerability in the component /jquery-file-upload/server/php/index.php of Hospital Management

CVE-2020-26629 CRITICAL POC
9.8 Jan 10

A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows
CVE-2024-40502 CRITICAL POC
9.8 Jul 22

SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute ar
CVE-2023-4176 CRITICAL POC
9.8 Aug 06

A vulnerability was found in SourceCodester Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vul
CVE-2023-3811 CRITICAL POC
9.8 Jul 21

A vulnerability was found in Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-3810 CRITICAL POC
9.8 Jul 21

A vulnerability was found in Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-3809 CRITICAL POC
9.8 Jul 21

A vulnerability was found in Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-31498 CRITICAL POC
9.8 May 11

A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
CVE-2022-38637 CRITICAL POC
9.8 Sep 13

Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Pa
CVE-2022-32095 CRITICAL POC
9.8 Jul 01

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orde
CVE-2022-32094 CRITICAL POC
9.8 Jul 01

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doc
CVE-2022-32093 CRITICAL POC
9.8 Jul 01

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adm

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-7176 REF https://phpgurukul.com/ REF https://vuldb.com/?ctiid.315115 REF https://vuldb.com/?id.315115 REF https://vuldb.com/?submit.606776

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy