CVE-2025-3955
published 2025-04-27CVE-2025-3955: A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.40%
33.4th percentile
A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file /edit_rpatient.php.php. The manipulation of the argument id/lastname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code-projects | patient_record_management_system | — | — |
| codeprojects | patient_record_management_system | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-47910 vhs: CrossOriginProtection bypass in net/http [fedora-43]
bugzilla·2025-09-25·CVSS 5.4
CVE-2025-47910 [MEDIUM] CVE-2025-47910 vhs: CrossOriginProtection bypass in net/http [fedora-43]
CVE-2025-47910 vhs: CrossOriginProtection bypass in net/http [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
https://pkg.go.dev/vuln/GO-2025-3955
This CVE affects golang apps built with golang "from go1.25.0 before go1.25.1", so really just golang 1.25.0 exactly. Here is the status across all current Fedora versions.
*
Bugzilla
CVE-2025-47910 net/http: CrossOriginProtection bypass in net/http
bugzilla·2025-09-22·CVSS 5.4
CVE-2025-47910 [MEDIUM] CVE-2025-47910 net/http: CrossOriginProtection bypass in net/http
CVE-2025-47910 net/http: CrossOriginProtection bypass in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Discussion:
Note: this is fixed in Golang 1.24.7 and 1.25.1 (https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ). A mass-rebuild of the packages listed in blocking bugs will fix this.
---
Other aliases for this are GHSA-8pjc-487g-w6p2 and GO-2025-3955:
https://github.com/advisories/GHSA-8pjc-487g-w6p2
https://pkg.go.dev/vuln/GO-2025-3955
---
(In reply to Dominik 'Rathann' Mierzejewski from comment #1)
>
2025-04-27
Published