CVE-2025-40693 - Cross Site Scripting in PHPGurukul Online Fire Reporting System

Back Back to CVE browser

MEDIUM

Cross Site Scripting in PHPGurukul Online Fire Reporting System

Published Sep 11, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.21%

Description

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname'

parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.

Affected products

Vendor PHP Gurukul Product Online Fire Reporting System Default
unaffected
- Version
  1.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PHP Gurukul

Online Fire Reporting System

unaffected

Version	Status	Constraints
1.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28896
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28896		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system		Third Party Advisory