CVE-2023-6425

CVE-2023-6425 is a persistent Cross-Site Scripting (XSS) vulnerability found in BigProf Online Clinic Management System 2.2. It arises from insufficient encoding of user-controlled input in the FirstRecord parameter within the /clinic/medical_records_view.php page. This allows an authenticated attacker to inject malicious JavaScript, which executes when other users view the affected page. The vulnerability has a CVSS score of 5.4 (Medium), indicating it can be exploited over a network with low attack complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 34/100. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.