CVE-2026-90850
LowCVSS 2.4Summary
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
Risk Assessment
An attacker can remotely inject malicious scripts, potentially leading to data theft, session hijacking, or unauthorized actions. The public exploit increases the risk.
Recommendation
It is recommended to update the system to the latest version or apply security patches, and to validate input data.
Other vulnerabilities in PHPGurukul Hostel Management System
See all- CVE-2026-90851Medium
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2025-63611High
The phpgurukul Hostel Management System v2.1 contains a Cross-Site Scripting (XSS) vulnerability in the user-provided complaint field (Explain the Complaint) submitted via /register-complaint.php. Injected HTML/JavaScript is stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>), causing it to execute in the admin's browser.
- CVE-2025-45953Critical
A vulnerability in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel (Change Password component) allows session hijacking. Improper session data handling enables remote session takeover.
Original NVD description (English source)
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.