Live › vulnerability › CVE-2026-111942
Go to dashboardThe Blood_Bank_Management_System 1.0.0 web application does not sanitize the Search argument in /abs.php, so a crafted link can inject script into a page. A victim who opens such a link can have script run in their browser session, which can expose cookies or actions taken as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run hrisikeshpal Blood_Bank_Management_System 1.0.0 with /abs.php reachable by users or the internet are exposed. Systems that do not deploy this project can skip it.
No product ranges from the sources yet.
Blood_Bank_Management_System and abs.php1.0.0 from the project files or repository tagsSearch parameter from /abs.php by hand, and encode output in that fileEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-111942")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.