The CVSS 7.3 rating and 'exploit has been published' language for this SQL injection in the Hospital Information System project suggest active exploitation risk, but the EPSS score of 0.00328 tells a different story — roughly a 0.33% chance of exploitation in the next 30 days, which is notably low. This mismatch deserves scrutiny before you deprioritize this finding.
The 'code-projects Hospital Information System' almost certainly refers to source code hosted on code-projects.org, a repository notorious for educational projects, tutorials, and student work rather than hardened enterprise software. These projects are typically deployed in academic settings, personal learning environments, or abandoned entirely — not in operational hospital infrastructure.
But here's why the EPSS number may be misleading: low scores for niche or educational code often mean nobody has automated scanning for this target yet, not that the risk is negligible if deployed. The deployment pipeline for this code provides zero friction — an IT administrator at a small clinic searching for 'free hospital software' finds it, downloads it, and deploys it without understanding it's educational code never designed for hostile environments. Automated exploit scanners don't ask whether a target is production or educational; they fire the SQL injection payload and move on. The blast radius is identical either way: patient health information, appointment records, and billing data are exposed regardless of the deployer's intent.
The more durable risk is proliferation. This specific codebase has almost certainly been copy-pasted into derivative systems — modified, integrated into existing infrastructure, and deployed in contexts nobody would associate with the original project. Those derivatives don't carry the CVE and aren't tracked by EPSS, but they share the same structural SQL injection vulnerability. The vulnerability signature is now a permanent part of attacker automation, usable against any PHP codebase exhibiting similar patterns.
For defenders: treat the CVSS 7.3 as the operative severity metric, not the EPSS probability. If you run any PHP-based hospital or practice management software — especially anything downloaded from code repositories or modified from open-source templates — audit it for SQL injection in authentication and data retrieval paths. The question isn't whether this exact codebase is deployed; it's whether this vulnerability pattern has already migrated into systems you manage.