CVE-2025-66918

HIGH

edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.6%
Percentile46th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

CWE-79: Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 53
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-79
via CWE-79
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in the admin/add-session.php file through the 'title' parameter, allowing attackers to inject malicious scripts into web pages viewed by other users.

BSID: BS-2025-GLOBAL-246519-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-66918?
The edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in the admin/add-session.php file through the 'title' parameter, allowing attackers to inject malicious scripts into web pages viewed by other users.
What is the CVSS score for CVE-2025-66918?
CVE-2025-66918 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2025-66918 actively exploited?
No confirmed active exploitation of CVE-2025-66918 as of 2026-10-15.
How do I remediate CVE-2025-66918?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-66918?
CVE-2025-66918 affects Hashenudara Edoc-Doctor-Appointment-System.
Vulnerability Details
CVE IDCVE-2025-66918
BSIDBS-2025-GLOBAL-246519-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2025-12-11
Last Modified2026-10-14
ICS Relevance0%
Weakness (CWE)
Improper Input ValidationCross-Site Scripting (XSS)
SourceNVD
Official Description

edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by submitting a malicious script through the 'title' parameter in the admin/add-session.php form. This script can then be executed in the browser of any user who views the affected page, potentially leading to unauthorized actions, data theft, or session hijacking.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Hashenudara Edoc-Doctor-Appointment-System 1.0.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 308 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash746f5cba315fc130a9676da517b937bf5e233abb4af1fac67d9a7bac6caa95cc38d8c4d97465dc1c01610217bbcb7dae85b5108a703a3061de4d176de42c8d1d
Related CVEs affecting Hashenudara
CVE-2025-65358 9.8 Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection... CVE-2022-36543 9.8 Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injecti... CVE-2022-36544 9.8 Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injecti... CVE-2022-36545 9.8 Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injecti... CVE-2022-36546 8.8 Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site ...
View all Hashenudara CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →