CVE-2025-45805

In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment.

CVSS v3.1 CNA

7.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2025-09-03

Updated

2025-12-16

Proof-of-concept exploits (1)

• mohammed-alsaqqaf/CVE-2025-458050★ · 2025-12-15

Security advisories

• mhsinj/CVE-2025-45805
• https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql

References

• CVE Record
• NVD entry