CVE-2025-9773
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A flaw was found in RemoteClinic up to 2.0 affecting unknown code of the /staff/edit.php file. Manipulating the Last Name argument leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been published.
Risk Assessment
XSS may allow an attacker to execute script in a victim's browser, stealing sessions or credentials. The public exploit increases the likelihood of exploitation.
Recommendation
Update RemoteClinic or implement input validation and encoding in /staff/edit.php. Deploy CSP headers to restrict script execution.
Other vulnerabilities in RemoteClinic
See all- CVE-2025-9802Medium
A vulnerability was detected in RemoteClinic 2.0 affecting unknown code in /staff/profile.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely.
- CVE-2025-9774Medium
A vulnerability was found in RemoteClinic up to version 2.0 affecting the file /patients/edit-patient.php. Manipulation of the Email argument leads to information disclosure. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing manipulation of the argument Last Name can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS