| शीर्षक | PHPGurukul Student Record Management System 1.0 Stored XSS in [/edit-course.php] endpoint on [Course Short Name] |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability exists in Student Record Management System Version 1.0 developed by PHPGurukul. The vulnerability is present in the /edit-course.php endpoint, specifically in the Course Short Name field. The application fails to properly validate and encode user-supplied input before storing it in the database and rendering it in the browser.
An authenticated administrator can inject malicious JavaScript code into the Course Short Name field via the add course functionality. The payload is stored in the database and executed when the course is viewed or edited through the manage courses functionality. |
|---|
| स्रोत | ⚠️ https://github.com/AS-AbdulSamad/CVEs/issues/2 |
|---|
| उपयोगकर्ता | AS-AbdulSamad (UID 95469) |
|---|
| सबमिशन | 19/02/2026 08:11 PM (8 महीनों पहले) |
|---|
| संयम | 01/03/2026 07:49 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 348297 [PHPGurukul Student Record Management System तक 1.0 /edit-course.php Course Short Name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|