Which versions of Patient Record Management System are affected by CVE-2025-6452?

CVE-2025-6452 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for CVE-2025-6452?

Yes, a public proof-of-concept exploit is available for CVE-2025-6452. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6452?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Patient Record Management System CVE-2025-6452

Q: What is the CVSS score of CVE-2025-6452?

CVE-2025-6452 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18877 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-22 cna@vuldb.com

XSS Patient Record Management System Codeastro

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.4 LOW

Requires high privileges and user interaction; low integrity impact only.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.4 (LOW) 1.9 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 21:55 euvd

EUVD-2025-18877

Analysis Generated

Mar 15, 2026 - 21:55 vuln.today

PoC Detected

Jun 27, 2025 - 17:01 vuln.today

Public exploit code

CVE Published

Jun 22, 2025 - 03:15 cve.org

LOW 1.9

CVE Published

Jun 22, 2025 - 03:15 nvd

LOW 2.4

DescriptionCVE.org

A vulnerability was found in CodeAstro Patient Record Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Generate New Report Page. The manipulation of the argument Patient Name/Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Cross-site scripting (XSS) in CodeAstro Patient Record Management System 1.0 allows an authenticated high-privilege user to inject arbitrary JavaScript via the Patient Name/Name argument on the Generate New Report Page. Publicly available exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating low exploitation likelihood.

Technical ContextAI

The vulnerability is a stored cross-site scripting (XSS) issue, classified under CWE-79. The affected component is the Generate New Report Page, where user-supplied input (Patient Name/Name) is not properly sanitized before being rendered. The CPE indicates the product is CodeAstro Patient Record Management System version 1.0. XSS occurs when an application includes untrusted data in a web page without proper validation or escaping, allowing attackers to execute scripts in the context of another user's browser.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, implement input validation and output encoding for the Patient Name/Name field on the Generate New Report Page. Specifically, sanitize user input to remove or escape HTML/JavaScript characters. Additionally, apply Content Security Policy (CSP) headers to mitigate XSS impact. Note that these workarounds may require code changes and testing.