{"id":"CVE-2026-111942","kind":"vulnerability","aliases":["CVE-2026-111942"],"related":[],"title":"Blood Bank Management System: reflected XSS in search parameter of abs.php","description":"A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Blood_Bank_Management_System 1.0.0 web application does not sanitize the Search argument in /abs.php, so a crafted link can inject script into a page. A victim who opens such a link can have script run in their browser session, which can expose cookies or actions taken as that user.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blood-bank-management-system","other","php","self-hosted"],"not_affected_if":["project-not-deployed"],"how_to_check":"- Check whether the project is deployed by searching your codebase or server for `Blood_Bank_Management_System` and `abs.php`\n- Confirm the installed version is `1.0.0` from the project files or repository tags\n- unknown for further checks, as the sources do not describe a specific test","fix":"- unknown: the sources report the project has not responded to the issue report and do not name a patched version or workaround\n- Until a fix exists, restrict access to the application or remove the `Search` parameter from /abs.php by hand, and encode output in that file","status":"open","published_at":"2026-10-18T07:16:53+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:30:57+00:00","updated_at":"2026-10-25T04:30:57+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:30:57Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report the project has not responded to the issue report and do not name a patched version or workaround\n- Until a fix exists, restrict access to the application or remove the `Search` parameter from /abs.php by hand, and encode output in that file","reach":"internet","title":"Blood Bank Management System: reflected XSS in search parameter of abs.php","impact":"medium","summary":"The Blood_Bank_Management_System 1.0.0 web application does not sanitize the Search argument in /abs.php, so a crafted link can inject script into a page. A victim who opens such a link can have script run in their browser session, which can expose cookies or actions taken as that user.","category":"other","nicknames":[],"who_cares":["blood-bank-management-system","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a victim's browser session on the application","analyst_note":"Confirm whether a public proof of concept exists and whether any fixed version or vendor response appears at the NVD entry, CVE-2026-111942.","how_to_check":"- Check whether the project is deployed by searching your codebase or server for `Blood_Bank_Management_System` and `abs.php`\n- Confirm the installed version is `1.0.0` from the project files or repository tags\n- unknown for further checks, as the sources do not describe a specific test","needs_analyst":true,"not_affected_if":["project-not-deployed"],"who_is_affected":"Teams that run hrisikeshpal Blood_Bank_Management_System 1.0.0 with /abs.php reachable by users or the internet are exposed. Systems that do not deploy this project can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3345,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111942':14A,17A '-2026':13A,16A '/abs.php':43B,99C '1.0.0':33B,90C 'abs.php':11A 'action':74B 'applic':35B 'argument':41B,104C 'attack':111C,130C 'avail':121C 'bank':2A,20B,30B,87C 'blood':1A,19B,29B,86C 'blood-bank-management-system':18B 'browser':67B 'caus':106C 'cooki':72B 'could':126C 'craft':46B 'cross':107C 'cve':12A,15A 'earli':138C 'exploit':117C 'expos':71B 'file':98C 'function':95C 'host':27B 'hrisikeshp':85C 'identifi':83C 'impact':91C 'inform':134C 'initi':114C 'inject':49B 'issu':141C 'link':47B,60B 'made':120C 'manag':3A,21B,31B,88C 'manipul':101C 'open':57B 'page':53B 'paramet':9A 'php':24B 'problem':137C 'project':132C 'public':124C 'reflect':5A 'remot':115C 'report':142C 'respond':146C 'run':64B 'sanit':38B 'script':50B,63B,109C 'search':8A,40B,105C 'self':26B 'self-host':25B 'session':68B 'site':108C 'system':4A,22B,32B,89C 'taken':75B 'unknown':94C 'use':128C 'user':78B 'victim':55B 'weak':80C 'web':34B 'xss':6A 'yet':147C","nicknames":[],"mitigations":[],"who_affected":"Teams that run hrisikeshpal Blood_Bank_Management_System 1.0.0 with /abs.php reachable by users or the internet are exposed. Systems that do not deploy this project can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111942","severity":null,"published_at":"2026-10-18T07:16:53+00:00","modified_at":"2026-10-19T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}