BaseFortify

Publication date: 2025-12-01

Last updated on: 2025-12-04

Assigner: MITRE

Description

A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the rname, remail, rpassword, rphone, rcity parameters, which are then executed in the victim's browser when the page is viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-01

Last Modified

2025-12-04

Generated

2026-07-07

AI Q&A

2025-12-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63533

EUVD

EUVD-2025-199993

Affected Vendors & Products

Vendor	Product	Version / Range
shridharshukl	blood_bank_management_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Blood Bank Management System 1.0, specifically in the updateprofile.php and rprofile.php components. The system does not properly sanitize or encode user input in certain parameters (rname, remail, rpassword, rphone, rcity), allowing an attacker to inject malicious JavaScript code that executes in the victim's browser when they view the affected page.

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the context of a victim's browser, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the victim within the Blood Bank Management System.

Hi! I’m here to help you understand CVE-2025-63533. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70