Is there a public PoC exploit available for CVE-2025-7943?

Yes, a public proof-of-concept exploit is available for CVE-2025-7943. Prioritise patching immediately. EPSS: 0.1%.

PHPGurukul Taxi Stand Management System CVE-2025-7943

Q: What is the CVSS score of CVE-2025-7943?

CVE-2025-7943 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-21 cna@vuldb.com

PHP XSS Auto Taxi Stand Management System Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:46 vuln.today

DescriptionCVE.org

A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-autoortaxi.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in PHPGurukul Taxi Stand Management System 1.0 allows remote attackers to inject arbitrary JavaScript via the searchdata parameter in /admin/search-autoortaxi.php. The vulnerability requires user interaction (clicking a malicious link) but no authentication. Publicly available exploit code exists, though EPSS score (0.07%) indicates low real-world exploitation probability relative to CVSS severity.

Technical ContextAI

The vulnerability exists in a PHP-based administrative search function that fails to properly sanitize user input from the searchdata parameter before reflecting it in HTTP responses. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates insufficient output encoding or input validation. The affected endpoint /admin/search-autoortaxi.php processes search queries without escaping or filtering potentially malicious HTML/JavaScript characters, allowing attackers to embed executable scripts that execute in the context of an admin user's session if they visit a crafted URL.

RemediationAI

No vendor-released patch has been identified at time of analysis. Contact PHPGurukul directly via https://phpgurukul.com/ to request a security update for version 1.0. As an immediate compensating control, implement strict input validation and output encoding in the /admin/search-autoortaxi.php file: validate the searchdata parameter against a whitelist of allowed characters (alphanumeric, spaces, and necessary operators), and HTML-encode all output before rendering search results. Alternatively, restrict administrative interface access to trusted IP ranges or require a Web Application Firewall (WAF) rule that filters reflected XSS payloads (e.g., detecting script tags in the searchdata parameter). These controls reduce exploitability but do not eliminate the underlying code defect.