CVE-2025-7754

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /xray_form.php. The manipulation of the argument itr_no leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Patient Record Management System	1.0

References

https://code-projects.org/Product
https://github.com/Damon-Gilbert/damon-blog/blob/main/cve-zy.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.316744Permissions Required, VDB Entry
https://vuldb.com/?id.316744Third Party Advisory, VDB Entry
https://vuldb.com/?submit.615537Third Party Advisory, VDB Entry

Timeline

Published: Jul 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-77558.8A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown proces CVE-2025-77564.3A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipula CVE-2025-77579.8A vulnerability classified as critical was found in PHPGurukul Land Record System 1.0. Affected by this vulnerability is an unknown function CVE-2025-77588.8A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the CVE-2025-77598.8A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/j CVE-2025-77607.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Tech CVE-2025-77615.1Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allow CVE-2025-77626.5A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing o CVE-2025-77634.3A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the fil CVE-2025-77649.8A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown functio CVE-2025-77659.8A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is a CVE-2025-77668.0Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to u