CVE-2022-34611
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.
Risk Assessment
The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, malicious redirects, or sensitive data exfiltration.
Recommendation
Update the system to the latest version or implement input filtering (validation and sanitization) for the "Contac #" field and use Content-Security-Policy headers.
Other vulnerabilities in Online Fire Reporting System
See all- CVE-2025-40690Critical
SQL injection vulnerability in Online Fire Reporting System v1.2 by PHPGurukul. It allows an attacker to retrieve, create, update, and delete databases via the 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.
- CVE-2025-40693Medium
The Online Fire Reporting System v1.2 by PHPGurukul contains a Stored XSS vulnerability in the endpoint '/ofrs/admin/edit-team.php'. Lack of validation of the 'tname' (GET) and 'teamleadname', 'teammember', 'teamname' (POST) parameters allows an attacker to inject a malicious script that can be stored and executed for an authenticated user.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "Contac #" text field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS