CVE-2025-63512
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
kishan0725 Hospital Management System v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the doctor deletion logic. The application fails to properly sanitize or parameterize user-supplied input from the demail parameter before incorporating it into a dynamic SQL query.
Risk Assessment
An attacker can inject arbitrary SQL commands, potentially leading to data leakage, modification, or deletion of database contents, including patient and doctor data.
Recommendation
Update the application to a non-vulnerable version or implement parameterized queries (prepared statements) for the demail parameter and all user input.
Other vulnerabilities in Hospital Management System
See all- CVE-2025-69943Critical
The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in get_doctor.php via the doctor and specilizationid parameters.
- CVE-2025-69942Critical
kishan0725 Hospital Management System 4.0 contains a SQL injection vulnerability in /hms/doctor/view-patient.php via the viewid parameter.
- CVE-2025-65340Critical
SQL Injection vulnerability in Hospital Management System 4.0. An attacker can inject malicious SQL via the /betweendates-detailsreports.php file.
- CVE-2026-82914High
In kishan0725 Hospital-Management-System 1.0, a SQL injection vulnerability was discovered in /search.php via manipulation of the Contact argument. The attack can be launched remotely, and the exploit has been released publicly.
- CVE-2026-76991Medium
A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation of the argument delid results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
- CVE-2026-75086Medium
A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /viewroom.php. Manipulation of the argument delid in an unknown function allows remote attack execution. The exploit has been publicly disclosed and may be used.
- CVE-2026-20000Medium
SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in file /viewprescriptionrecord.php via the delid argument. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-19973Medium
A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
- CVE-2026-19972Medium
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2026-19934Medium
The Hospital Management System 1.0 from itsourcecode has a SQL Injection vulnerability in /vieworder.php. Manipulation of the 'delid' argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. The application fails to properly sanitize or parameterize user-supplied input from the demail parameter before incorporating it directly into a dynamic SQL query.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS