CVE-2025-6408

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Campcodes Online Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Online Hospital Management System	1.0

References

https://github.com/ASantsSec/CVE/issues/15Exploit, Third Party Advisory
https://vuldb.com/?ctiid.313402Permissions Required, VDB Entry
https://vuldb.com/?id.313402Third Party Advisory, VDB Entry
https://vuldb.com/?submit.598207Third Party Advisory, VDB Entry
https://www.campcodes.com/Product
https://github.com/ASantsSec/CVE/issues/15Exploit, Third Party Advisory

Timeline

Published: Jun 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-640819.8SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attac CVE-2025-640845.4An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers CVE-2025-640857.5A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a De CVE-2025-640867.5A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to caus CVE-2025-640879.8A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers CVE-2025-64099.8A vulnerability was found in PHPGurukul Art Gallery Management System 1.1 and classified as critical. This issue affects some unknown proces CVE-2025-640908.8This vulnerability allows authenticated attackers to execute commands via the hostname of the device.CVE-2025-640918.8This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.CVE-2025-640927.5This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying d CVE-2025-640939.8Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.CVE-2025-640945.4DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization CVE-2025-640959.8DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default H