CVE-2025-11390
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A weakness in PHPGurukul Cyber Cafe Management System 1.0 in /search.php (POST Parameter Handler) allows manipulation of the searchdata argument leading to cross-site scripting. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
An attacker could execute malicious scripts in a victim's browser, potentially leading to data theft, session hijacking, or other harmful actions.
Recommendation
Update the system to the latest version and implement input validation and sanitization for the searchdata parameter.
Other vulnerabilities in PHPGurukul Cyber Cafe Management System
See all- CVE-2025-70893High
A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fails to properly sanitize user-supplied input provided via the adminname parameter, allowing authenticated attackers to inject arbitrary SQL expressions.
- CVE-2025-70892Critical
Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint.
- CVE-2023-34666Medium
The Phpgurukul Cyber Cafe Management System version 1.0 has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML via the admin username parameter.
Original NVD description (English source)
A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.php of the component POST Parameter Handler. Executing a manipulation of the argument searchdata can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS