CVE-2026-111942
Received Received - Intake

Cross-Site Scripting in Blood Bank Management System 1.0.0

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111942
EUVD
EUVD-2026-103402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hrisikeshpal Blood_Bank_Management_System 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in the Blood_Bank_Management_System 1.0.0. It exists in the search parameter of the abs.php file. When a user inputs malicious script code into the search field, the system fails to sanitize the input, allowing the script to execute in the browser of other users who view the affected page. The exploit can be triggered remotely via a crafted URL.

Detection Guidance

To detect this XSS vulnerability, inspect the Blood_Bank_Management_System for improper input sanitization in the search parameter of abs.php. Check for user-supplied input being rendered without escaping in web pages. Use browser developer tools to inspect network requests and responses for the Search parameter. Test with payloads like <script>alert(1)</script> in the search field.

  • Check GitHub repository for vulnerable code patterns in abs.php handling the Search parameter.
Impact Analysis

This XSS vulnerability could allow attackers to steal user session cookies, redirect users to malicious websites, or perform actions on behalf of users without their consent. For example, an attacker could inject a script that captures login credentials or personal data when users interact with the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal data. GDPR requires protection of personal data, and HIPAA mandates safeguards for health information. An XSS attack may expose sensitive user or patient data, violating these regulations and potentially resulting in legal penalties.

Mitigation Strategies

Immediately sanitize all user inputs, especially the Search parameter in abs.php, using functions like htmlspecialchars() in PHP. Implement Content Security Policy (CSP) headers to mitigate XSS impact. Update to the latest patched version if available. Monitor for unusual activity or script injections in web requests.

  • Restrict input to expected formats and reject any input containing script tags or special characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111942. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart