CVE-2025-2868 — Cross-site Scripting in Queuing System

CWE-79 — Cross-site ScriptingCWE-1284 — Improper Validation of Specified Quantity in Input4 documents4 sources
Severity
4.8MEDIUMNVD
EPSS
0.1%
top 67.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Clinic Queuing SystemOretnom23 Clinic Queuing System
Timeline
PublishedMar 28

Description

Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-7f6m-mrqm-frhj: Reflected Cross-Site Scripting (XSS) vulnerability in version 1↗2025-03-28
▶
CVEList
Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System↗2025-03-28
▶

📋Vendor Advisories

1
Microsoft
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.↗2022-08-09
▶
CVE-2025-2868 — Cross-site Scripting in Queuing System | cvebase