Security Advisory

CVE-2025-41003

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-01-12 13:50:34

Last updated 2026-01-12 14:29:51

Assigner INCIBE

CVSS score 5.1

State PUBLISHED

Description

Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.php’. By injecting a malicious script into the ‘firstname’ parameter, the JavaScript code is stored and executed every time a user accesses the patient list, allowing an attacker to execute arbitrary JavaScript in a victim's browser.

← Browse all CVEs View on cve.org ↗