CVE-2025-40693
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Online Fire Reporting System v1.2 by PHPGurukul contains a Stored XSS vulnerability in the endpoint '/ofrs/admin/edit-team.php'. Lack of validation of the 'tname' (GET) and 'teamleadname', 'teammember', 'teamname' (POST) parameters allows an attacker to inject a malicious script that can be stored and executed for an authenticated user.
Risk Assessment
An attacker can send a specially crafted query to an authenticated user, potentially leading to session cookie theft and account takeover.
Recommendation
Apply proper input validation and sanitization for the 'tname', 'teamleadname', 'teammember', and 'teamname' parameters and consider updating the system to a patched version.
Other vulnerabilities in Online Fire Reporting System
See all- CVE-2025-40690Critical
SQL injection vulnerability in Online Fire Reporting System v1.2 by PHPGurukul. It allows an attacker to retrieve, create, update, and delete databases via the 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.
- CVE-2022-34611Medium
A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.
Original NVD description (English source)
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname' parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS