What is the CVSS score of EUVD-2025-210539?

EUVD-2025-210539 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Hospital Management System are affected by EUVD-2025-210539?

SQL injection vulnerability (CVE-2025-69945) in Hospital Management System 4.0 enables attackers to access, expose, and alter patient records through publicly available exploit code; healthcare…

How to fix or mitigate EUVD-2025-210539?

Within 24 hours: audit all instances of Hospital Management System 4.0, disable the vulnerable /doctor/edit-patient.php endpoint if operationally feasible, and implement Web Application Firewall (WAF) rules to block SQL injection attempts in the 'editid' parameter. Within 7 days: implement input validation and parameterized queries to sanitize the 'editid' parameter, and conduct penetration testing to verify remediation effectiveness. Within 30 days: develop and execute an upgrade strategy to a patched version or alternative healthcare management system, and establish permanent WAF policies for ongoing SQL injection prevention.

Hospital Management System EUVD-2025-210539

| CVE-2025-69945 HIGH

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-9r9x-mp6x-7vh3

PHP SQLi N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable, low-complexity injection, but the /doctor/ endpoint typically requires an authenticated doctor session, so PR:L rather than NVD's PR:N; impacts remain Low across C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:38 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

7.3 (HIGH)

CVE Published

Jul 29, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.

AnalysisAI

SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers manipulate database queries through the unsanitized 'editid' GET parameter of /doctor/edit-patient.php. Successful injection can expose or alter stored patient records and potentially the whole application database. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.14%, though a public technical write-up documenting the injection point exists.

Technical ContextAI

The affected component is a PHP web application (kishan0725 Hospital Management System, an open-source project) backed by a relational database, most likely MySQL/MariaDB via mysqli or PDO. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'editid' parameter passed to /doctor/edit-patient.php is concatenated directly into a SQL query without parameterization or input validation, so attacker-controlled input alters query structure. The CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), and the vendor/product are effectively 'n/a' in the EUVD/NVD records, so identification relies on the CVE description and the GitHub write-up rather than structured CPE.

RemediationAI

No vendor-released patch version was identified at time of analysis, and affected-version data is 'n/a', so no fixed release can be cited. The correct code-level fix is to replace string concatenation with parameterized queries/prepared statements (mysqli or PDO bound parameters) for the 'editid' value and to enforce server-side type validation (cast editid to an integer) before any database call. As compensating controls: restrict access to the /doctor/ directory so only authenticated doctor sessions can reach edit-patient.php (trade-off: none if auth is already required, but confirms the intended access model); deploy a WAF rule to block SQL metacharacters and UNION/OR-based payloads on the editid parameter (trade-off: may cause false positives on legitimate input and is bypassable); and enable least-privilege database accounts so the web user cannot read/alter tables beyond what the app needs (trade-off: requires schema-aware grant review). Track the NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-69945) and VulDB (https://vuldb.com/vuln/384306) entries for any published fix.