EUVD-2025-20325Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor.html of the component POST Parameter Handler. The manipulation of the argument First Name/Last name/Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Stored cross-site scripting in CodeAstro Simple Hospital Management System 1.0 allows authenticated remote attackers to inject JavaScript via First Name, Last name, or Address fields in the doctor.html POST handler. The script executes in a victim's browser when the page is viewed, potentially enabling session hijacking or data theft. Publicly available exploit code exists, but no active exploitation has been confirmed and EPSS estimates very low exploitation probability (0.05%).
A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Rated medium se
Stored cross-site scripting in CodeAstro Simple Hospital Management System 1.0 allows authenticated attackers to inject
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today