CVE-2019-25473: Softwebinternational Clinic Pro

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Clinic Pro contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the month parameter. Attackers can send POST requests to the monthly_expense_overview endpoint with crafted month values using boolean-based blind, time-based blind, or error-based SQL injection techniques to extract sensitive database information.

Affected products

• Softwebinternational Clinic Pro: any version

Published 2026-03-12. Last modified 2026-06-17.