Is there a public PoC exploit available for CVE-2025-7925?

Yes, a public proof-of-concept exploit is available for CVE-2025-7925. Prioritise patching immediately. EPSS: 0.1%.

PHPGurukul Online Banquet Booking System CVE-2025-7925

Q: What is the CVSS score of CVE-2025-7925?

CVE-2025-7925 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-21 cna@vuldb.com

PHP XSS Online Banquet Booking System Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:25 vuln.today

DescriptionCVE.org

A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument user_login/userpassword leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stored or reflected cross-site scripting (XSS) vulnerability in PHPGurukul Online Banquet Booking System 1.0 allows remote attackers to inject malicious scripts via the user_login or userpassword parameters in /admin/login.php. User interaction is required for exploitation. Publicly available exploit code exists, and EPSS score of 0.10% indicates low real-world exploitation probability despite public disclosure.

Technical ContextAI

The vulnerability is a CWE-79 improper neutralization of input during web page generation (cross-site scripting). The login form at /admin/login.php in this PHP-based banquet booking system fails to properly sanitize or escape user input from the user_login and userpassword parameters before rendering them in HTML responses. This allows attackers to inject arbitrary JavaScript that executes in the context of an admin's browser session. The affected product is PHPGurukul Online Banquet Booking System version 1.0, identified by CPE cpe:2.3:a:phpgurukul:online_banquet_booking_system:1.0:*:*:*:*:*:*:*. As a PHP application, it likely uses traditional server-side session handling and may store user input in logs or temporary files without proper encoding.

RemediationAI

Apply input validation and output encoding to the user_login and userpassword parameters in /admin/login.php. Use a templating engine or library that automatically escapes HTML special characters (e.g., PHP's htmlspecialchars() or htmlentities()) when rendering user input in HTML context. Implement Content Security Policy (CSP) headers to prevent inline script execution as a defense-in-depth measure. If using a framework like Laravel or CodeIgniter, ensure form builders apply automatic CSRF and XSS protections. No vendor-released patch version is publicly available at this time; contact phpgurukul.com directly for patched releases or self-remediate by reviewing all user input handling in login.php and applying context-specific output encoding. Test the fix by attempting to submit '<script>alert(1)</script>' in the user_login field and confirming it renders as text, not executable code.