PT-2025-13473 · Unknown · Clinic Queuing System

Rafael Pedrero · Published 2025-03-28 · Updated 2025-10-15 · CVE-2025-2870

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Clinic Queuing System version 1.0

Description The issue is a Reflected Cross-Site Scripting (XSS) vulnerability. This could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in "/patient side.php" API endpoint.

Recommendations For Clinic Queuing System version 1.0, consider disabling the /patient side.php endpoint until a patch is available, or restrict access to it to minimize the risk of exploitation. Avoid using the page parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-2870

Affected Products

Clinic Queuing System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-2870 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2870 · Vendor Advisory
• https://t.me/cvenotify/116708 · Telegram Post
• https://twitter.com/CVEnew/status/1905674385027166271 · Twitter Post
• https://t.me/cvedetector/21392 · Telegram Post
• https://t.me/cveNotify/138808 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system · Note