Is there a public PoC exploit available for CVE-2025-7815?

Yes, a public proof-of-concept exploit is available for CVE-2025-7815. Prioritise patching immediately. EPSS: 0.1%.

PHPGurukul Apartment Visitors Management System CVE-2025-7815

Q: What is the CVSS score of CVE-2025-7815?

CVE-2025-7815 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-19 cna@vuldb.com

PHP XSS Apartment Visitors Management System Phpgurukul

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:21 vuln.today

DescriptionCVE.org

A vulnerability, which was classified as problematic, has been found in PHPGurukul Apartment Visitors Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

AnalysisAI

Cross-site scripting vulnerability in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the visname parameter in the /manage-newvisitors.php endpoint, exploitable only when the victim user clicks a crafted link. The CVSS score of 1.9 reflects the severe privilege requirement (PR:H), mandatory user interaction (UI:P), and limited impact (integrity only); EPSS exploitation probability is minimal at 0.05%, indicating this poses negligible real-world risk despite publicly available exploit code.

Technical ContextAI

The vulnerability is a reflected or stored cross-site scripting (XSS) flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), occurring in the HTTP POST request handler for /manage-newvisitors.php. The visname parameter fails to sanitize or encode user-supplied input before rendering it in the response, allowing an attacker to inject arbitrary HTML and JavaScript. The PHP application processes visitor registration data without implementing output encoding or content security policy controls. This is a common pattern in PHP management applications when user-facing forms lack proper input validation and output encoding libraries.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary mitigation is to upgrade to a newer version if available, or contact PHPGurukul for security updates. As an immediate compensating control, implement HTML entity encoding (using PHP htmlspecialchars() or htmlentities() with ENT_QUOTES) on all output derived from the visname parameter and other user inputs in /manage-newvisitors.php. Additionally, enforce Content-Security-Policy (CSP) headers with strict script-src directives to prevent inline script execution. Restrict administrative access to /manage-newvisitors.php to trusted users only and disable high-privilege user accounts that are no longer in active use. Implement input validation to reject visname values containing HTML special characters (<, >, ", ', &) at the point of entry.