CVE-2025-9802
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was detected in RemoteClinic 2.0 affecting unknown code in /staff/profile.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The risk affects RemoteClinic instances accessible from the network.
Recommendation
Update RemoteClinic to a patched version or apply mitigations (e.g., input validation, WAF). Restrict access to the application to trusted networks.
Other vulnerabilities in RemoteClinic
See all- CVE-2025-9774Medium
A vulnerability was found in RemoteClinic up to version 2.0 affecting the file /patients/edit-patient.php. Manipulation of the Email argument leads to information disclosure. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-9773Medium
A flaw was found in RemoteClinic up to 2.0 affecting unknown code of the /staff/edit.php file. Manipulating the Last Name argument leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been published.
Original NVD description (English source)
A vulnerability was detected in RemoteClinic 2.0. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS