CVE-2025-63611

High

Published: 08/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

The phpgurukul Hostel Management System v2.1 contains a Cross-Site Scripting (XSS) vulnerability in the user-provided complaint field (Explain the Complaint) submitted via /register-complaint.php. Injected HTML/JavaScript is stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>), causing it to execute in the admin's browser.

Risk Assessment

The risk includes the possibility of executing malicious scripts in the context of the admin session, which could lead to data theft, session hijacking, or further attacks on the system.

Recommendation

It is recommended to update the system to a version that includes a fix for the XSS vulnerability. Additionally, apply proper output encoding in the admin viewer.

Other vulnerabilities in phpgurukul Hostel Management System

CVE-2025-45953Critical
A vulnerability in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel (Change Password component) allows session hijacking. Improper session data handling enables remote session takeover.

Original NVD description (English source)

Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.