An authenticated cross-site scripting vulnerability in the Blood Bank Management System 1.0 poses a high risk of session hijacking and unauthorized administrative actions.

This is a stored cross-site scripting (XSS) vulnerability located in the updateprofile.php and hprofile.php components. An authenticated attacker can inject malicious JavaScript into the hname, hemail, hpassword, hphone, or hcity parameters, which executes in the context of the victim's browser session.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of other users, including administrators. This can lead to the theft of session cookies, account takeover, or unauthorized modification of blood bank data. With a CVSS score of 8.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the management platform.

Immediate Action: Since no vendor patch is currently available, administrators should restrict access to the affected profile management components to trusted users only.

Proactive Monitoring: Review application logs for unusual input patterns in profile update requests and monitor for suspicious administrative account activity.

Compensating Controls: Implement a strict Content Security Policy (CSP) and ensure a Web Application Firewall is configured to block common script injection patterns in profile fields.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced by the CVE record.

Given the lack of a formal vendor patch, organizations utilizing the Blood Bank Management System 1.0 must treat this as a high-priority risk. Immediately implement input validation or block access to the vulnerable profile update pages to prevent potential account compromise. Monitor the vendor's repository for any future security updates and apply them as soon as they become available.