CVE-2025-45805
HIGH 1 PoC
MEDIUM
Priority: 0.03
BB Relevance:
75/100
Published: 2025-09-03
Modified: 2026-11-07
First seen: 2026-11-07
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
Low
A:
Low
Description
In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| phpgurukul | doctor_appointment_management_system | 1.0.0 |
References & Advisories (3)
Third Party Advisory
Product