Vulnerability · Published Apr 1, 2025 · Assigned by rapid7
CVE-2025-3096Clinics Patient Management System SQL Injection
Critical 9.3
In plain English
A critical-severity SQL injection in Clinic's Patient Management System from SourceCodester. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)1.5%top 25.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Clinic's Patient Management System | 2.0 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N