Cyber Resilience

CVE-2025-3096

Critical

Published: 01 April 2025

Published
01 April 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.4762 97.8th percentile
Risk Priority 47 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3096 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Clinic’s Patient Management System version 2.0 contains a SQL injection vulnerability (CWE-89) on the login page. The flaw received a CVSS 4.0 score of 9.3 with network attack vector, low complexity, and no required authentication or user interaction, resulting in high confidentiality and integrity impact while availability remains unaffected.

An unauthenticated attacker with network access can submit crafted input through the login page to manipulate backend database queries. Successful exploitation allows the attacker to bypass authentication, extract sensitive patient or administrative data, and potentially alter records stored in the system.

The EPSS score rose from lower values after the April 2025 disclosure to a peak of 0.6262 on 2026-02-07 before receding to the current 0.4762, indicating a period of increased exploitation interest that later declined. The listed references point to the vendor source-code repository and an unrelated CVE record but supply no mitigation details.

EU & UK References

Vulnerability details

Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Patient Management System
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References