Stored Cross Site Scripting in Online Fire Reporting System by PHPGurukul
CVE-2025-40694

5.1MEDIUM

Key Information:

Vendor

PHPgurukul
Status
Online Fire Reporting System
Vendor
CVE Published:
11 September 2025

What is CVE-2025-40694?

The Online Fire Reporting System v1.2 by PHPGurukul is susceptible to a stored Cross Site Scripting (XSS) vulnerability. This arises from inadequate validation of user input parameters 'fromdate' and 'todate' via POST requests at the endpoint '/ofrs/admin/bwdates-report-result.php'. Exploitation of this vulnerability allows remote attackers to craft malicious queries targeting authenticated users, potentially leading to the theft of their cookie session details and compromising user account security.

Affected Version(s)

Online Fire Reporting System 1.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.
CVE-2025-40694 : Stored Cross Site Scripting in Online Fire Reporting System by PHPGurukul