CVE-2025-3096
Published: 01 April 2025
Summary
CVE-2025-3096 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Clinic’s Patient Management System version 2.0 contains a SQL injection vulnerability (CWE-89) on the login page. The flaw received a CVSS 4.0 score of 9.3 with network attack vector, low complexity, and no required authentication or user interaction, resulting in high confidentiality and integrity impact while availability remains unaffected.
An unauthenticated attacker with network access can submit crafted input through the login page to manipulate backend database queries. Successful exploitation allows the attacker to bypass authentication, extract sensitive patient or administrative data, and potentially alter records stored in the system.
The EPSS score rose from lower values after the April 2025 disclosure to a peak of 0.6262 on 2026-02-07 before receding to the current 0.4762, indicating a period of increased exploitation interest that later declined. The listed references point to the vendor source-code repository and an unrelated CVE record but supply no mitigation details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9493
Vulnerability details
Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.