Medium severity · published Sep 1, 2025
CVE-2025-9753
Campcodes Online Hospital Management System Patient Search patient-search.php cross site scripting
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was detected in Campcodes Online Hospital Management System 1.0. The affected element is an unknown function of the file /admin/patient-search.php of the component Patient Search Module. Performing manipulation of the argument Search by Name Mobile No results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OH
Online Hospital Management System · Campcodes
1.0 · source: vendor, NVD
Affected product
OH
Online Hospital Management System
Campcodes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9753
Exploit
https://github.com/Yashh-G/zero-day-research/blob/main/HMS_XSS_In_Patient_search_Feild.pdf
Permissions Required
https://vuldb.com/?ctiid.322054
Third Party Advisory
https://vuldb.com/?id.322054
Third Party Advisory
https://vuldb.com/?submit.640609
Product
https://www.campcodes.com/
More from Online Hospital Management System
9.8
CVE-2025-6408
Campcodes Online Hospital Management System search.php sql injection
9.8
CVE-2025-6407
Campcodes Online Hospital Management System user-login.php sql injection
9.8
CVE-2025-6406
Campcodes Online Hospital Management System forgot-password.php sql injection
9.8
CVE-2025-5604
Campcodes Hospital Management System user-login.php sql injection
9.8
CVE-2025-5603
Campcodes Hospital Management System registration.php sql injection