CVE-2025-9774
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability was found in RemoteClinic up to version 2.0 affecting the file /patients/edit-patient.php. Manipulation of the Email argument leads to information disclosure. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
An attacker could remotely access sensitive information, potentially compromising patient privacy and regulatory compliance. The public availability of the exploit increases the risk of exploitation.
Recommendation
Update RemoteClinic to the latest version or apply the vendor patch. Until then, restrict access to edit-patient.php and monitor for suspicious requests.
Other vulnerabilities in RemoteClinic
See all- CVE-2025-9802Medium
A vulnerability was detected in RemoteClinic 2.0 affecting unknown code in /staff/profile.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely.
- CVE-2025-9773Medium
A flaw was found in RemoteClinic up to 2.0 affecting unknown code of the /staff/edit.php file. Manipulating the Last Name argument leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been published.
Original NVD description (English source)
A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation of the argument Email leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS