CVE-2025-11038

MediumCVSS 6.3

Published: 26/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

A SQL injection vulnerability was identified in itsourcecode Online Clinic Management System 1.0 in the /details.php?action=post file. Manipulation of the ID argument allows remote exploitation. The exploit has been made public.

Risk Assessment

An attacker can gain unauthorized access to the database, potentially leading to data leakage or modification.

Recommendation

Apply parameterized SQL queries and update the system to a patched version.

Other vulnerabilities in itsourcecode Online Clinic Management System

CVE-2025-10618Medium
A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to SQL injection. The attack may be launched remotely and the exploit has been disclosed publicly.

Original NVD description (English source)

A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Affected is an unknown function of the file /details.php?action=post. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS