Online Fire Reporting System vulnerabilities

SQL injection vulnerability in Online Fire Reporting System v1.2 by PHPGurukul. It allows an attacker to retrieve, create, update, and delete databases via the 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.

The Online Fire Reporting System v1.2 by PHPGurukul contains a Stored XSS vulnerability in the endpoint '/ofrs/admin/edit-team.php'. Lack of validation of the 'tname' (GET) and 'teamleadname', 'teammember', 'teamname' (POST) parameters allows an attacker to inject a malicious script that can be stored and executed for an authenticated user.

A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.