CVE-2025-2664

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in CodeZips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /suadpeted.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
CodeZipsHospital Management System1.0

References

Timeline

Published
Mar 23, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-266407.0Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-266417.5Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.CVE-2025-266427.8Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-266435.4The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2025-266445.1Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorCVE-2025-266458.8Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2025-266468.0External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoCVE-2025-266478.8Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.CVE-2025-266487.8Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-266497.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized aCVE-2025-26659.8A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been classified as critical. This affects an unknowCVE-2025-266516.5Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVE-2025-2664: High severity, CVSS 7.2 | Vulnix