EUVD-2026-54496
GHSA-fjmg-2773-pqx4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-level auth required (PR:H), victim must view page (UI:R), XSS crosses to victim's browser session (S:C), with low C and I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the fullname parameter in /manage-newvisitors.php, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). The affected component is the PHP script /manage-newvisitors.php within PHPGurukul's Company Visitor Management System, a PHP-based web application for tracking facility visitors. The fullname POST/GET argument is reflected or stored without adequate output encoding or input sanitization, enabling injection of arbitrary HTML/JavaScript into the page rendered by other authenticated or administrative users. The CPE string cpe:2.3:a:phpgurukul:company_visitor_management_system:*:*:*:*:*:*:*:* with a wildcard version suggests all released versions are potentially affected, though the disclosure targets version 1.0 specifically.
RemediationAI
No vendor-released patch or patched version has been identified at time of analysis. Organizations using PHPGurukul Company Visitor Management System 1.0 should apply output encoding (e.g., htmlspecialchars() with ENT_QUOTES) to all user-controlled input rendered in HTML contexts, particularly the fullname field in /manage-newvisitors.php; this is a source-level fix requiring code modification and carries no functional trade-offs. As a compensating control, deploying a Web Application Firewall (WAF) with an XSS ruleset can block common payload patterns at the network layer, though sophisticated encodings may bypass signature-based rules. Restricting access to the admin panel and /manage-newvisitors.php to internal networks or VPN-only access reduces the attack surface by preventing external exploitation. Monitor the PHPGurukul project page (https://phpgurukul.com/) for a patched release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today