VulnerabilityModified
CVE-2021-25791
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name,…
MEDIUM 5.4EPSS 2.54%
Does this matter?
Lower severity and a low EPSS score (2.54%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 2.54% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- online doctor appointment system php full source code project/online doctor appointment system php full source code
- Source
- cve@mitre.org
References
- https://www.exploit-db.com/exploits/49396Exploit, Third Party Advisory, VDB Entry
- https://www.sourcecodester.comProduct
- https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.htmlProduct
- https://www.exploit-db.com/exploits/49396Exploit, Third Party Advisory, VDB Entry
- https://www.sourcecodester.comProduct
- https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.htmlProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.