Vulnerability · Published Dec 1, 2025 · Assigned by mitre
CVE-2025-63533
High 8.5
In plain English
A high-severity cross-site scripting in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the rname, remail, rpassword, rphone, rcity parameters, which are then executed in the victim's browser when the page is viewed.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:C/UI:N