Vulnerabilities

TI-2019-15778 CVE-2019-25728 · GHSA-vr4m-89wj-3qwx

Care2x 2.7 Hospital Information System SQL Injection via ck_config

HIGH 77

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00262 Published 2026-06-04 No fix listed CWE-89

TI-2021-14713 CVE-2021-36352 · GHSA-vp28-h326-q553

Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management…

LOW 25

Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00652 Published 2021-08-26 No fix listed CWE-79

TI-2021-14712 CVE-2021-36351 · GHSA-48pp-5ggg-3xjr

SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7…

MEDIUM 46

SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear parameters in GET requests sent to /modules/nursing/nursing-station.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01852 Published 2021-08-06 No fix listed CWE-89

TI-2007-05205 CVE-2007-5418 · GHSA-c8jh-w9vh-3vj2

Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote…

LOW 38

Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) en_copyrite.php, (2) vi_copyrite.php, and (3) ar_copyri…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02733 Published 2007-10-12 No fix listed CWE-94

TI-2007-01515 CVE-2007-1574 · GHSA-c8cv-jxxq-p694

CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration…

LOW 25

CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01118 Published 2007-03-21 No fix listed

TI-2007-01400 CVE-2007-1458 · GHSA-2qj4-m7p4-848p

Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers…

MEDIUM 40

Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) inc_checkdate_lang.php, (2) inc_charset_fx.php, (3) inc_co…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.07246 Published 2007-03-14 No fix listed