‹ Back to list

CVE-2022-3956

Status: ModifiedCritical (9.8)—
Severity9.8Critical · CVSS 3.1
Exploitation probability0.73 %higher than 54% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The manipulation of the argument PID leads to sql injection. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. VDB-213462 is the identifier assigned to this vulnerability.

CVSS

Base score
9.8
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.73 %
Percentile among all scored CVEs
54
Score date
10/22/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Hhims Project — Hhims

CWEs

References

Show 4 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-3956",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-3956",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-14T16:57:51.288129Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "tsruban",
          "product": "HHIMS",
          "versions": [
            {
              "status": "affected",
              "version": "2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-11T16:15:16.600",
  "references": [
    {
      "url": "https://github.com/tsruban/HHIMS/issues/1",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.213462",
      "tags": [
        "Permissions Required",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/tsruban/HHIMS/issues/1",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?id.213462",
      "tags": [
        "Permissions Required",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-707"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The manipulation of the argument PID leads to sql injection. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. VDB-213462 is the identifier assigned to this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido encontrada en tsruban HHIMS 2.1 y clasificada como crítica. Una función desconocida del componente Patient Portrait Handler es afectada por esta función. La manipulación del argumento PID conduce a la inyección de SQL. Es posible lanzar el ataque de forma remota. Se recomienda aplicar un parche para solucionar este problema. VDB-213462 es el identificador asignado a esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T05:00:39.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hhims_project:hhims:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F28FC5A-E893-4329-9C9E-EC815596E624"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@vuldb.com"
}