← Vulnerability feed

Vulnerability record · CVE-2025-63526 · published 1 December 2025

CVE-2025-63526: Shridharshukl blood bank management system cross-site scripting vulnerability

SShridharshukl · Blood Bank Management System

A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the msg parameter, which is then executed in the victim's browser when the page is viewed.

5.4 CVSS 3.1 Medium EPSS 0.33% · top 76.6% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the msg parameter, which is then executed in the victim's browser when the page is viewed.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing ExploitThird Party Advisory
https://github.com/Shridharshukl/Blood-Bank-Management-System Product
https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63526.md Exploit

Track CVE-2025-63526 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-63531Shridharshukl blood bank management system sql injection vulnerabilityA SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properl…EPSS 0.65%8.8CVE-2025-63535Shridharshukl blood bank management system sql injection vulnerabilityA SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize…EPSS 0.39%8.8CVE-2025-63532Shridharshukl blood bank management system sql injection vulnerabilityA SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanit…EPSS 0.39%8.8CVE-2025-63525Shridharshukl blood bank management system improper access control vulnerabilityAn issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges via crafted…EPSS 0.49%8.8CVE-2025-63529Shridharshukl blood bank management system vulnerabilityA session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session i…EPSS 0.37%5.4CVE-2025-63534Shridharshukl blood bank management system cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component. The application fails to pr…EPSS 0.22%5.4CVE-2025-63533Shridharshukl blood bank management system cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. T…EPSS 0.22%5.4CVE-2025-63527Shridharshukl blood bank management system cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php components. T…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2025-63526), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.