CVE-2025-6406

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/forgot-password.php. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Online Hospital Management System	1.0

References

https://github.com/ASantsSec/CVE/issues/11Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.313400Permissions Required, VDB Entry
https://vuldb.com/?id.313400Third Party Advisory, VDB Entry
https://vuldb.com/?submit.598204Third Party Advisory, VDB Entry
https://www.campcodes.com/Product
https://github.com/ASantsSec/CVE/issues/11Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-640614.3Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any CVE-2025-640628.8The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation agains CVE-2025-640639.8Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard u CVE-2025-640648.8Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify t CVE-2025-640658.8The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative Logi CVE-2025-640668.6Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to impl CVE-2025-640675.3Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) f CVE-2025-64079.8A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. This affects an unknown par CVE-2025-640705.4Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field.CVE-2025-640745.3A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to CVE-2025-6407510.0A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to CVE-2025-640767.5Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (sour