CVE-2025-45805

In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment.

CVSS v3.1

7.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2025-09-03

Updated

2025-12-16

Proof-of-concept exploits (1)

• mohammed-alsaqqaf/CVE-2025-45805

References

• CVE Record
• NVD entry

Related

• CVE-2025-45800
• CVE-2025-45809
• CVE-2025-4580
• CVE-2025-45813
• CVE-2025-45786
• CVE-2025-45814