Blood Bank System CVE-2026-111942

Exploitation requires the attacker to deliver a crafted URL targeting the Search argument of /abs.php and have a victim load it (UI:P / passive user interaction is the key limiting factor). No authentication is required (PR:N) and the attack is remote over the network (AV:N), but it is a reflected XSS, so it depends on social engineering to get a user to follow the attacker-controlled request against a running Blood_Bank_Management_System 1.0.0 instance. There is no confidentiality or availability impact; impact is limited to script execution in the victim's browser session. No non-default configuration is indicated as required by the description.

This is a reflected cross-site scripting flaw (CWE-79) in the Search argument of /abs.php in hrisikeshpal Blood_Bank_Management_System 1.0.0. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) is network-reachable with low complexity and no privileges, but requires passive user interaction (UI:P) and yields only low integrity impact with no confidentiality or availability impact - consistent with a score of 5.3 (medium). The signals are internally coherent and point to low-to-medium real-world risk: publicly available exploit code exists (reported by VulDB, with a GitHub issue referenced as the exploit), but there is NO CISA KEV listing, so this is 'publicly available exploit code exists' and NOT confirmed active exploitation - these are distinct signals and must not be conflated. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The dominant risk-limiting factor is that exploitation requires tricking a victim into clicking a crafted link (UI:P), and the affected product is an obscure single-developer GitHub project with negligible production footprint. The vendor was notified via an issue report but has not responded, so no patch is confirmed available. Net: a legitimate but low-priority medium-severity issue - the high accessibility (remote, unauthenticated) is offset by required user interaction, limited impact, and minimal deployment.

An attacker crafts a URL to /abs.php with a malicious script payload in the Search parameter and sends it to a victim (e.g., via phishing). When the victim clicks the link, the reflected payload executes in their browser in the context of the Blood Bank Management System site, enabling session/cookie theft or UI manipulation. Public exploit material exists (referenced GitHub issue), lowering the effort required.