CVE-2025-64081

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Dec 8, 2025

CISA due date

—

The record

SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.

Affected packages

Ecosystem	Package	Introduced	Fixed