CVE-2025-39386CWE-89

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability

Critical · published May 19, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

🚨 SQL injection vulnerability in the mojoomla Hospital Management System could let attackers access your database with just a malicious input! 🔥 Think of it like a chef who trusts any order slip that comes in without checking. If someone slips a prank order, they might end up cooking something wild and unwanted — that’s how easily an attacker can tamper with your database here! An attacker could gain full access to sensitive hospital data, change patient records, or even wipe out critical information. This could lead to absolutely devastating consequences for patient care and hospital operations!

Put simply

Think of it like a chef who trusts any order slip that comes in without checking. If someone slips a prank order, they might end up cooking something wild and unwanted — that’s how easily an attacker can tamper with your database here! This vulnerability stems from improper neutralization of special elements used in SQL commands, allowing an attacker to execute arbitrary SQL queries against the Hospital Management System database.

What to do

An attacker could gain full access to sensitive hospital data, change patient records, or even wipe out critical information. This could lead to absolutely devastating consequences for patient care and hospital operations! Immediate action is required: upgrade to version 47.1 or later of the Hospital Management System. Additionally, ensure your SQL queries are properly parameterized to prevent injections in the future. 🛡️ You can tackle this issue head-on! Follow these steps and secure your system like the hero you are! 💪

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-05-19T19:34Z
EPSS history
Timeline
  • 19 MAY 19:34Z
    WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability
    cvelistv5