What is GHSA-vr4m-89wj-3qwx?

GHSA-vr4m-89wj-3qwx is a security advisory published by GitHub Security Advisories with High severity. Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers...

Which CVE IDs does GHSA-vr4m-89wj-3qwx cover?

GHSA-vr4m-89wj-3qwx covers the following CVE IDs: CVE-2019-25728. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vr4m-89wj-3qwx?

GHSA-vr4m-89wj-3qwx has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

GHSA-vr4m-89wj-3qwxHighCVSS 8.2

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers...

Vendor

GitHub Security Advisories

Published

June 4, 2026

Last Modified

June 4, 2026

🔗 CVE IDs covered (1)

CVE-2019-25728 →

📋 Description

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-25728
https://www.exploit-db.com/exploits/46268
https://www.vulncheck.com/advisories/care2x-hospital-information-system-sql-injection-via-ck-config
https://github.com/advisories/GHSA-vr4m-89wj-3qwx