What is the CVSS score of CVE-2025-65342?

CVE-2025-65342 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Blood System CVE-2025-65342

EUVD-2025-210559 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 mitre

GHSA-xgq3-c6r3-vx84

XSS PHP N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-accessible public form (AV:N, PR:N), victim click required (UI:R), script executes in browser outside server origin (S:C), limited confidentiality and integrity impact on victim session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:38 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.1 (MEDIUM)

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.

AnalysisAI

Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.

Technical ContextAI

Blood System 1.0 is a PHP-based blood donation management web application from the code-projects portfolio, primarily used for academic or demonstration purposes. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the city field submitted to /don.php is rendered back into the HTML response without output encoding or sanitization, allowing an attacker to inject arbitrary HTML and JavaScript. The CVSS Changed scope indicates the injected script executes in the victim's browser security context rather than the server's, meaning the impact falls on the end user rather than the server itself. Research was surfaced by the TaintRadar static taint analysis tool, suggesting the vulnerability was identified through automated source-to-sink tracing in the PHP codebase. CPE data is listed as generic (n/a), indicating no formal vendor CPE assignment exists.

RemediationAI

No vendor-released patch has been identified at time of analysis; code-projects Blood System appears to be an unmaintained educational project with no active development. The primary fix is to apply PHP output encoding to the city field before rendering it in HTML responses - specifically, wrapping the reflected value with htmlspecialchars($city, ENT_QUOTES, 'UTF-8') to neutralize injected markup. If the application must remain deployed, a Web Application Firewall (WAF) rule blocking script injection patterns in the city parameter can serve as a compensating control, though WAF bypasses exist and this is not a substitute for code-level fixes. Deploying a Content Security Policy (CSP) header that restricts inline script execution (script-src 'self') would significantly reduce XSS exploitability as a defense-in-depth measure, with the trade-off that any existing inline scripts in the application would need to be refactored. Given the educational nature of this product, the most practical recommendation is to avoid deploying it in any environment handling real user data.