CVE-2023-6425

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/medical_records_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2023-11-30

Updated

2026-02-06

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51439

References

• CVE Record
• NVD entry

Related

• CVE-2023-6421
• CVE-2023-6438
• CVE-2023-6402
• CVE-2023-6439
• CVE-2023-6401
• CVE-2023-6440