Is there a public PoC exploit available for CVE-2025-7944?

Yes, a public proof-of-concept exploit is available for CVE-2025-7944. Prioritise patching immediately. EPSS: 0.1%.

PHPGurukul Taxi Stand Management System CVE-2025-7944

Q: What is the CVSS score of CVE-2025-7944?

CVE-2025-7944 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-21 cna@vuldb.com

PHP XSS Auto Taxi Stand Management System Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:46 vuln.today

DescriptionCVE.org

A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Cross-site scripting (XSS) in PHPGurukul Taxi Stand Management System 1.0 allows remote attackers to inject malicious scripts via the searchdata parameter in /search.php. The vulnerability requires user interaction (clicking a malicious link) and has limited integrity impact. A publicly available proof-of-concept exists, though EPSS score of 0.07% suggests minimal real-world exploitation probability despite active public disclosure.

Technical ContextAI

This is a reflected cross-site scripting (CWE-79) vulnerability in a PHP-based web application. The /search.php endpoint fails to properly sanitize user input from the searchdata parameter before reflecting it in the HTTP response, allowing an attacker to inject arbitrary JavaScript code. The underlying issue is insufficient input validation and output encoding in a server-side PHP application processing search functionality. The attack vector is network-based, requiring no authentication, but mandates user interaction (UI:P in CVSS 4.0 vector) to trigger the malicious payload.

RemediationAI

No vendor-released patch has been identified at the time of analysis. Immediate remediation requires input validation and output encoding in the /search.php file: (1) Validate the searchdata parameter to accept only expected character sets (alphanumeric, spaces, etc.) and reject or encode special characters; (2) Apply context-appropriate output encoding (HTML entity encoding) when reflecting search data in HTML responses, preventing JavaScript execution; (3) Implement Content Security Policy (CSP) headers to restrict inline script execution; (4) If the application is internally used or non-critical, restrict network access to /search.php to trusted IP ranges or require authentication before the search functionality is available. Contact phpgurukul.com directly for patch availability or consider migrating to an actively maintained alternative if the project is no longer supported.