CVE-2025-2870 MEDIUM

CVE-2025-2870: Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System

Vendor Clinic Queuing System
Product Clinic Queuing System
Weakness CWE-79 · XSS
Published March 28, 2025
Last update March 28, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php.

Key dates

02Disclosure timeline

March 28, 2025 CVE published
March 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-29175 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking CVE-2025-8293 Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter CVE-2026-5721 wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 6.5.0.4 - Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import CVE-2021-29448 Stored DOM XSS in Pi-hole Admin Web Interface CVE-2024-27993 WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability