Stored XSS Vulnerability in Online Fire Reporting System by PHPGurukul

CVE-2025-40693

What is CVE-2025-40693?

The Online Fire Reporting System v1.2 by PHPGurukul contains a vulnerability that allows for stored Cross-Site Scripting (XSS). This vulnerability arises due to insufficient validation of user inputs, specifically the 'tname' parameter via GET requests and 'teamleadname', 'teammember', and 'teamname' parameters via POST requests at the '/ofrs/admin/edit-team.php' endpoint. An attacker can exploit this flaw by crafting a malicious query that targets authenticated users, potentially allowing the attacker to capture cookie session details.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References