CVE-2024-44635
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious JavaScript that executes in the user's browser.
Risk Assessment
XSS vulnerability may allow session data theft, admin account takeover, or page interface modification, potentially resulting in unauthorized access to student data.
Recommendation
Update the software to a patched version or implement proper input filtering and encoding for the adminname and aemailid parameters.
Other vulnerabilities in PHPGurukul Student Record System
See all- CVE-2024-44639Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. An attacker can manipulate SQL queries when adding a subject.
- CVE-2024-44636Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious SQL queries to gain unauthorized access to the database.
- CVE-2024-44632Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. An attacker can manipulate SQL queries during password recovery.
Original NVD description (English source)
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS