CVE-2021-42868
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability was found in Chikista Patient Management Software 2.0.2 in the first_name parameter. It affects the following pages: patient/insert, patient_report, appointment_report, visit_report, and bill_detail_report.
Risk Assessment
An attacker can inject a malicious JavaScript script that executes in the victim's browser, potentially leading to session theft, account takeover, or leakage of sensitive patient data.
Recommendation
Immediately update the software to the latest version and implement input filtering and validation, especially for the first_name parameter.
Original NVD description (English source)
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. .