CVE-2025-13577
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A cross site scripting flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php, and manipulation of the cdetails argument leads to script execution. The attack can be launched remotely and the exploit has been published.
Risk Assessment
An attacker can remotely inject a malicious script via the cdetails argument that executes in the user's browser, potentially leading to session or data theft. The public availability of the exploit increases the risk of exploitation.
Recommendation
Update Hostel Management System to a fixed version or implement input validation and sanitization of the cdetails argument in the file /register-complaint.php. Until a fix is available, restrict access to the administrative panel.
Other vulnerabilities in PHPGurukul Hostel Management System
See all- CVE-2025-63611High
The phpgurukul Hostel Management System v2.1 contains a Cross-Site Scripting (XSS) vulnerability in the user-provided complaint field (Explain the Complaint) submitted via /register-complaint.php. Injected HTML/JavaScript is stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>), causing it to execute in the admin's browser.
- CVE-2025-45953Critical
A vulnerability in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel (Change Password component) allows session hijacking. Improper session data handling enables remote session takeover.
- CVE-2026-90851Medium
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2026-90850Low
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
Original NVD description (English source)
A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a manipulation of the argument cdetails can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS