The vulnerability is a reflected or stored cross‑site scripting flaw located in the Blood System 1.0 web application. It occurs in the /don.php endpoint when the city form field is processed and reflected in page output without proper sanitization. An attacker who can supply a crafted value for the city field can cause arbitrary JavaScript to run in the context of a victim’s browser, enabling actions such as cookie theft, account hijacking, or defacement of site content.

The affected product is the open‑source Blood System 1.0 application. No specific vendor is listed, and the only affected version mentioned is 1.0. Because the CNA vendors/products entry is marked n/a, administrators should verify that their deployment matches this version and inspect the /don.php code for the vulnerability.

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves a user interacting with the web interface, submitting a malicious payload in the city field, and the victim’s browser executing the reflected script. Harm is confined to the privileges of the authenticated user, but a compromise of an administrative session could lead to broader impact.