Medium severity · published Jun 18, 2024
CVE-2024-37803
Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname and lname parameters under the Staff Info page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
HC
Health Care Hospital Management System
Health Care Hospital Management System Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37803
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37803
Product
https://code-projects.org/health-care-hospital-in-php-css-js-and-mysql-free-download/
Exploit
https://github.com/himanshubindra/CVEs/blob/main/CVE-2024-37803
More from Health Care Hospital Management System
8.8
CVE-2024-37802
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module via the searvalu parameter
8.8
CVE-2024-38347
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information module via the id parameter
8.8
CVE-2024-38348
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module via the searvalu parameter