CVE-2025-64081

SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2025-12-08

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• pamzey:patients_waiting_area_queue_management_system

References

• https://packetstorm.news/files/id/211592
• https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html

Check your stackJSON