CVE-2025-63497

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Nov 10, 2025

CISA due date

—

The record

The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vulnerability. The pat_number GET parameter is directly concatenated into SQL queries without proper sanitization, allowing authenticated attackers (doctor role) to execute arbitrary SQL queries.

Affected packages

Ecosystem	Package	Introduced	Fixed