---
id: "CVE-2026-111942"
kind: "vulnerability"
aliases: ["CVE-2026-111942"]
title: "Blood Bank Management System: reflected XSS in search parameter of abs.php"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["blood-bank-management-system", "other", "php", "self-hosted"]
not_affected_if: ["project-not-deployed"]
published_at: "2026-10-18T07:16:53+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111942", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Blood Bank Management System: reflected XSS in search parameter of abs.php

The Blood_Bank_Management_System 1.0.0 web application does not sanitize the Search argument in /abs.php, so a crafted link can inject script into a page. A victim who opens such a link can have script run in their browser session, which can expose cookies or actions taken as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project is deployed by searching your codebase or server for `Blood_Bank_Management_System` and `abs.php`
- Confirm the installed version is `1.0.0` from the project files or repository tags
- unknown for further checks, as the sources do not describe a specific test

## Fix

- unknown: the sources report the project has not responded to the issue report and do not name a patched version or workaround
- Until a fix exists, restrict access to the application or remove the `Search` parameter from /abs.php by hand, and encode output in that file

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111942

## From the sources

A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_