CVE-2025-27263

HIGH

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows SQL Injection.This is...

Affects 0 products across 2 vendors.

CVSS 3.18.5
EPSS0.5%
Percentile39th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, no integrity impact.
CWE Weakness Definitions
CWE-89: SQL Injection

Attacker inserts SQL commands into application queries through user-controlled input, allowing unauthorized database access.

Related Attack Patterns (CAPEC)
CAPEC-7 Blind SQL Injection
via CWE-89
CAPEC-108 Command Line Execution through SQL Injection
via CWE-89
CAPEC-109 Object Relational Mapping Injection
via CWE-89
CAPEC-110 SQL Injection through SOAP Parameter Tampering
via CWE-89
CAPEC-470 Expanding Control over the Operating System from the Database
via CWE-89
Show all 6
via CWE-89

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A SQL Injection vulnerability exists in Creativeitem Doctor Appointment Booking version 1.0.0 and below, allowing attackers to manipulate SQL queries through improper neutralization of special elements.

BSID: BS-2025-GLOBAL-248804-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-27263?
A SQL Injection vulnerability exists in Creativeitem Doctor Appointment Booking version 1.0.0 and below, allowing attackers to manipulate SQL queries through improper neutralization of special elements.
What is the CVSS score for CVE-2025-27263?
CVE-2025-27263 has CVSS 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS: 0.5%.
Is CVE-2025-27263 actively exploited?
No confirmed active exploitation of CVE-2025-27263 as of 2026-05-30.
How do I remediate CVE-2025-27263?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-27263?
CVE-2025-27263 affects Booking; Creativeitem.
Vulnerability Details
CVE IDCVE-2025-27263
BSIDBS-2025-GLOBAL-248804-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Published2025-03-03
Last Modified2026-04-23
ICS Relevance0%
Weakness (CWE)
SQL Injection
SourceNVD
Official Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows SQL Injection.This issue affects Doctor Appointment Booking: from n/a through <= 1.0.0.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from the application's failure to properly sanitize user inputs before incorporating them into SQL queries. An attacker can exploit this by injecting malicious SQL code through input fields, potentially leading to unauthorized data access, modification, or deletion.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Booking — —
Creativeitem — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 591 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash59ac9878f17354a3babd2f4044960160f7ef381a2326cab97098dd49919d733ddbf320688030ea96595bc25bca2c238765d52dae08deb3b6a15e424aee61c903
Related CVEs affecting Booking
CVE-2024-31115 10.0 Unrestricted Upload of File with Dangerous Type vulnerability in QuanticaLabs... CVE-2025-7634 9.8 The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin fo... CVE-2026-6960 9.8 The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file upl... CVE-2026-27095 9.8 Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket ... CVE-2026-27389 9.8 Authentication Bypass Using an Alternate Path or Channel vulnerability in des...
View all Booking CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →