CVE-2025-9746

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-9746
A vulnerability was detected in Campcodes Hospital Management System 1.0. This affects an unknown function of the file /admin/edit-doctor-specialization.php of the component Edit Doctor Specialization Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/Yashh-G/zero-day-research/blob/main/HMS_Stored_Cross-site_Scripting.docx Not Applicable
https://vuldb.com/?ctiid.322045 Permissions Required VDB Entry
https://vuldb.com/?id.322045 Third Party Advisory VDB Entry
https://vuldb.com/?submit.640411 Third Party Advisory VDB Entry
https://www.campcodes.com/ Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:campcodes:hospital_management_system:1.0:*:*:*:*:*:*:*
History

04 Sep 2025, 18:46

Type Values Removed Values Added
References () https://github.com/Yashh-G/zero-day-research/blob/main/HMS_Stored_Cross-site_Scripting.docx - () https://github.com/Yashh-G/zero-day-research/blob/main/HMS_Stored_Cross-site_Scripting.docx - Not Applicable
References () https://vuldb.com/?ctiid.322045 - () https://vuldb.com/?ctiid.322045 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.322045 - () https://vuldb.com/?id.322045 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.640411 - () https://vuldb.com/?submit.640411 - Third Party Advisory, VDB Entry
References () https://www.campcodes.com/ - () https://www.campcodes.com/ - Third Party Advisory, VDB Entry
First Time Campcodes
Campcodes hospital Management System
CPE cpe:2.3:a:campcodes:hospital_management_system:1.0:*:*:*:*:*:*:*

31 Aug 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-31 21:15

Updated : 2025-09-04 18:46

NVD link : CVE-2025-9746

Mitre link : CVE-2025-9746

CVE.ORG link : CVE-2025-9746

JSON object : View

Products Affected

campcodes

  • hospital_management_system
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')