Stored XSS Vulnerability in Online Fire Reporting System by PHPGurukul
CVE-2025-40693

5.1MEDIUM

Key Information:

Vendor

PHPgurukul
Status
Online Fire Reporting System
Vendor
CVE Published:
11 September 2025

What is CVE-2025-40693?

The Online Fire Reporting System v1.2 by PHPGurukul contains a vulnerability that allows for stored Cross-Site Scripting (XSS). This vulnerability arises due to insufficient validation of user inputs, specifically the 'tname' parameter via GET requests and 'teamleadname', 'teammember', and 'teamname' parameters via POST requests at the '/ofrs/admin/edit-team.php' endpoint. An attacker can exploit this flaw by crafting a malicious query that targets authenticated users, potentially allowing the attacker to capture cookie session details.

Affected Version(s)

Online Fire Reporting System 1.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.