Reflected Cross-Site Scripting Vulnerability in Clinic Queuing System by an Unknown Vendor

CVE-2025-2868

What is CVE-2025-2868?

A reflected Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Clinic Queuing System, enabling attackers to inject malicious scripts into the web application. By manipulating the page parameter in /index.php, an attacker can craft a malicious URL that, when accessed by a victim, triggers the execution of JavaScript code in their browser. This vulnerability poses significant risks, including unauthorized actions, data theft, and session hijacking, as it allows attackers to exploit client-side execution vulnerabilities within the affected product.

References