CVE-2024-53365
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. Authenticated users can inject malicious XSS scripts into the profile name field.
Risk Assessment
An attacker can steal other users' sessions, redirect them to malicious sites, or perform arbitrary actions on their behalf, compromising data confidentiality and integrity.
Recommendation
Update the system to the latest version and implement input validation and encoding for the profile name field to prevent script injection.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. This vulnerability allows authenticated users to inject malicious XSS scripts into the profile name field.