CVE-2025-65342 identifies a Cross Site Scripting (XSS) vulnerability in code-projects Blood System 1.0. The vulnerability exists in the /don.php page where the city field is not properly sanitized, allowing injection of malicious scripts. This can lead to partial confidentiality and integrity impacts, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No known exploits are reported in the wild, and no vendor remediation or patch information is currently provided.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of a victim's browser session when they visit the affected page. This can lead to limited confidentiality and integrity impacts, such as theft of user data or manipulation of displayed content. There is no impact on availability. The vulnerability requires user interaction and network access but no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the affected application. Implementing input validation and output encoding on the city field can help mitigate the risk.