The CVE reports a cross‑site scripting flaw in the abs.php script of the Blood Bank Management System. The vulnerability arises because the Search parameter is reflected into the page without proper encoding, allowing an attacker to inject arbitrary JavaScript. According to the description, the flaw can be triggered from a remote client, and public exploit code is already available. The impact of an execution would be session hijacking, credential theft, or defacement of the web interface, representing a typical XSS attack surface backed by CWE‑79 and a potential CWE‑94 code injection issue.

The only impacted release is Blood Bank Management System 1.0.0, distributed by the hrisikeshpal GitHub repository. No other versions or distributions are listed as vulnerable, and the flaw is contained exclusively to the /abs.php endpoint in that source code base.

The exploit path is a crafted HTTP request to abs.php, which does not require authentication and can be performed by any adversary on any instance exposed to the internet. The CVSS score of 5.3 indicates moderate severity, and the absence of an EPSS score leaves the quantitative exploitation probability unspecified. Although the flaw is not yet listed in CISA’s KEV catalog, the availability of public proof‑of‑concept code and the remote nature of the exploit warrant prompt attention.