| शीर्षक | PHPGurukul Daily Expense Tracker System 1.1 Cross Site Scripting |
|---|
| विवरण | PHPGurukul Daily Expense Tracker project contains stored Cross-Site Scripting vulnerabilities across multiple pages that render user-supplied data without output encoding. The user's full name stored in the database is echoed raw in the sidebar, which is included on every authenticated page. Expense items and costs entered by the user are displayed without escaping in the manage-expense and all report detailed views. Profile fields including name, email, and phone number are pre-populated in the profile edit form without encoding. This means any JavaScript payload injected into these database fields executes in the browser of anyone who views the affected pages.
|
|---|
| स्रोत | ⚠️ https://github.com/usernamevnq/CVEs/issues/6 |
|---|
| उपयोगकर्ता | n4k3r0 (UID 91985) |
|---|
| सबमिशन | 12/08/2026 11:44 AM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 07:07 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403397 [PHPGurukul Daily Expense Tracker System 1.1 sidebar.php FullName क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|