CVE-2025-65340 is a SQL injection vulnerability in a hospital management system with a CVSS 9.8 — the kind of severity that demands immediate attention, but the EPSS score of 0.0026 suggests low exploitation probability. Don't let that number comfort you. The low EPSS reflects the software's obscurity, not its safety. Healthcare software like this runs in concentrated deployments behind hospital firewalls, not exposed to the mass scanning that drives up EPSS for internet-facing targets. Sophisticated actors who target healthcare don't announce their interest with probe traffic — the absence of exploitation activity in your logs isn't evidence of safety.
The more immediate concern is whether this code is even being maintained. The vendor identifier 'kishan0725' suggests an individual developer or tiny operation, not an enterprise with security response capability. If the project is abandoned, no patch is coming regardless of CVE publication. Your remediation path isn't applying a vendor fix — it's either locating the original developer, forking to apply parameterized queries yourself, or replacing the system entirely.
For risk modeling: treat this as higher-risk than EPSS indicates specifically because the blast radius extends beyond data exfiltration. Hospital management systems integrate with billing, pharmacy, lab systems, and increasingly with networked medical devices. Compromising this database is often a pivot point for lateral movement into systems that directly affect patient care.
Practical steps: inventory whether this software runs in your environment, determine maintenance status, assume the database is already compromised until proven otherwise, and treat the integration layer as the critical boundary — not just the application itself.