CVE-2025-66918
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
Risk Assessment
An attacker can inject a malicious script that executes in the administrator's browser, potentially leading to session theft or account takeover.
Recommendation
Update the application to a patched version or implement validation and sanitization of the "title" parameter and deploy CSP headers.
Other vulnerabilities in edoc-doctor-appointment-system
See all- CVE-2025-65358Critical
Edoc-doctor-appointment-system v1.0.1 contains an SQL injection vulnerability via the 'docid' parameter at /admin/appointment.php.
- CVE-2026-116112High
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system in the file admin/add-new.php, where manipulation of the 'spec' argument leads to SQL injection. The attack can be performed remotely, and a publicly available exploit may be used. The product uses a rolling release model, so no version details are available.
Original NVD description (English source)
edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS