Vulnerability · Published Dec 1, 2025 · Assigned by mitre
CVE-2025-63527
High 8.5
In plain English
A high-severity cross-site scripting in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the hname, hemail, hpassword, hphone, hcity parameters, which are then executed in the victim's browser when the page is viewed.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:C/UI:N