Vulnerability · Published Sep 1, 2025 · Assigned by VulDB
CVE-2025-9753Campcodes Online Hospital Management System Patient Search patient-search.php cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in Online Hospital Management System from Campcodes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A vulnerability was detected in Campcodes Online Hospital Management System 1.0. The affected element is an unknown function of the file /admin/patient-search.php of the component Patient Search Module. Performing manipulation of the argument Search by Name Mobile No results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Campcodes | Online Hospital Management System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-322054 | Campcodes Online Hospital Management System Patient Search patient-search.php cross site scripting vdb-entry, technical-description
- VDB-322054 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #640609 | Campcodes Hospital Management System (Last Updated: August 18, 2024) Cross Site Scripting third-party-advisory
- https://github.com/Yashh-G/zero-day-research/blob/main/HMS_XSS_In_Patient_search_Feild.pdf exploit
- https://www.campcodes.com/ product