Which versions of COVID19 Testing Management System are affected by CVE-2025-6287?

CVE-2025-6287 is a low-severity vulnerability in A vulnerability classified as problematic involving cross-site scripting (CVSS 3.5).

How to fix or mitigate CVE-2025-6287?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

COVID19 Testing Management System CVE-2025-6287

Q: What is the CVSS score of CVE-2025-6287?

CVE-2025-6287 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18707 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-20 cna@vuldb.com

PHP XSS Covid19 Testing Management System Phpgurukul

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

PR:L due to auth required; UI:R; impact only integrity low.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18707

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 00:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability classified as problematic was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /test-details.php of the component Take Action. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in a PHP-based web application for managing COVID-19 testing records. The affected component is the 'Take Action' functionality in /test-details.php, where user-supplied input to the 'remark' parameter is not properly sanitized before being stored and later rendered in the browser. The CPE confirms the exact product and version: phpgurukul:covid19_testing_management_system:1.0.

RemediationAI

Upgrade to a patched version if available; otherwise, sanitize the 'remark' parameter input by implementing output encoding and input validation. As a workaround, restrict access to /test-details.php to trusted users only. No official patch has been identified at the time of analysis.