CVE-2025-66918 Details

A cross-site scripting (XSS) vulnerability has been identified in the Edoc Doctor Appointment System version 1.0.1. The issue resides in the admin/add-session.php file, where user input in the 'title' parameter is not properly sanitized before being stored in the database. This allows for the injection of malicious HTML, which is executed when the session is viewed by an admin, doctor, or patient. To exploit this vulnerability, an admin must create a session and inject a payload that redirects to an attacker-controlled site.

To address this vulnerability, sanitize the 'title' input by removing HTML tags and escaping output before rendering it in the HTML context. Consider using a library like HTMLPurifier if rich text input is necessary.