PHPGurukul Online Banquet Booking System CVE-2025-7925

Apply input validation and output encoding to the user_login and userpassword parameters in /admin/login.php. Use a templating engine or library that automatically escapes HTML special characters (e.g., PHP's htmlspecialchars() or htmlentities()) when rendering user input in HTML context. Implement Content Security Policy (CSP) headers to prevent inline script execution as a defense-in-depth measure. If using a framework like Laravel or CodeIgniter, ensure form builders apply automatic CSRF and XSS protections. No vendor-released patch version is publicly available at this time; contact phpgurukul.com directly for patched releases or self-remediate by reviewing all user input handling in login.php and applying context-specific output encoding. Test the fix by attempting to submit '<script>alert(1)</script>' in the user_login field and confirming it renders as text, not executable code.