CVE-2025-63611 | THREATINT

Description

Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.

PUBLISHED Reserved 2025-10-27 | Published 2026-01-08 | Updated 2026-01-08 | Assigner mitre

References

phpgurukul.com/hostel-management-system/

medium.com/...-in-hostel-management-system-v2-1-a23c2efc86ea

cve.org (CVE-2025-63611)

nvd.nist.gov (CVE-2025-63611)

Download JSON