CVE-2026-111942
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Blood_Bank_Management_System version 1.0.0 has a Cross-Site Scripting vulnerability in the /abs.php file due to manipulation of the Search argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can inject malicious script that executes in the victim's browser, leading to session data theft or other actions as the user. Since the exploit is public, the risk is high.
Recommendation
Since the project has not responded, it is recommended to discontinue use of this application or self-fix the vulnerability by validating and escaping input. Consider deploying a WAF.
Other vulnerabilities in Blood_Bank_Management_System
See all- CVE-2025-63535Critical
SQL injection vulnerability in Blood Bank Management System 1.0 in the abs.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.
- CVE-2025-63532Critical
SQL injection vulnerability in Blood Bank Management System 1.0 in the cancel.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.
- CVE-2025-63531Critical
SQL injection vulnerability in Blood Bank Management System 1.0 in the receiverLogin.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the remail and rpassword fields, an attacker can bypass authentication and gain unauthorized access to the system.
- CVE-2025-63525Critical
An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges via crafted request to delete.php.
- CVE-2025-63528High
Blood Bank Management System 1.0 contains a cross-site scripting (XSS) vulnerability in the blooddinfo.php component. The application fails to sanitize or encode user-supplied input before rendering, allowing malicious JavaScript injection via the error parameter. The script executes in the victim's browser when the page is viewed.
Original NVD description (English source)
A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS