What is the CVSS score of EUVD-2025-210538?

EUVD-2025-210538 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Hospital Management System are affected by EUVD-2025-210538?

Hospital Management System 4.0 contains an unauthenticated SQL injection vulnerability (CVE-2025-69949, CVSS 7.3) allowing remote attackers to read or modify patient records and operational data…

How to fix or mitigate EUVD-2025-210538?

Within 24 hours, inventory whether kishan0725's Hospital Management System 4.0 is deployed, identify all instances, and map their network exposure. Within 7 days, implement network segmentation to restrict check_availability.php access, deploy Web Application Firewall rules filtering SQL injection patterns in emailid and email parameters, and audit database access logs for anomalous queries. Within 30 days, evaluate migration to a maintained alternative or negotiate vendor-provided remediation; if retention is unavoidable, establish continuous monitoring for public exploits and formalize incident response procedures for potential database exfiltration.

Hospital Management System EUVD-2025-210538

| CVE-2025-69949 HIGH

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-fv9j-hvjm-h9xh

PHP SQLi N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.2 HIGH

Unauthenticated, low-complexity SQL injection typically enables full database read (C:H) with limited write (I:L); no direct availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:38 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

7.3 (HIGH)

CVE Published

Jul 29, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.

AnalysisAI

SQL injection in kishan0725's open-source Hospital Management System 4.0 lets remote attackers manipulate backend database queries through the check_availability.php endpoint via the unsanitized emailid and email parameters (CWE-89). The flaw carries a 7.3 CVSS score with a network/no-privilege vector, meaning it is reachable without authentication, though its EPSS probability is low (0.15%, 5th percentile) and no public exploit identified at time of analysis. The vulnerability is documented in the academic TaintRadar SQLi corpus but is not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP web application (per the PHP/SQLi tags) that backs a hospital appointment/availability workflow. The root cause class is CWE-89 (improper neutralization of special elements used in an SQL command): the check_availability.php script concatenates the user-controlled emailid and email request parameters directly into an SQL statement without parameterization or escaping, allowing an attacker to break out of the intended query context. CPE data is uninformative here - the published CPE (cpe:2.3:a:n/a:n/a) is a placeholder with no real vendor/product tokens - so the affected product must be identified from the description and reference URLs (the kishan0725 'hospitalmanagementsystemproject' on GitHub) rather than from structured CPE.

RemediationAI

No vendor-released patch identified at time of analysis; there is no tagged fixed release referenced in the provided data. The primary fix is to rewrite the check_availability.php database access to use parameterized queries / prepared statements (PDO or mysqli bound parameters) for the emailid and email parameters, and to apply strict input validation on those fields. As compensating controls until code is fixed: place the application behind a WAF with SQLi rules tuned to the check_availability.php endpoint (trade-off: signature evasion is possible and may cause false positives on legitimate email inputs), restrict network access to the application to trusted internal users only (trade-off: breaks any intended public appointment-availability use), and enforce least-privilege on the database account used by the app so the web user cannot read unrelated tables or write data (trade-off: may require schema/permission refactoring). Track vendor updates via the VulDB advisory (https://vuldb.com/vuln/384307) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-69949).