Stored XSS Vulnerability in Online Fire Reporting System by PHPGurukul

CVE-2025-40696

What is CVE-2025-40696?

The Online Fire Reporting System v1.2 by PHPGurukul is susceptible to a stored cross-site scripting vulnerability. This issue arises from inadequate validation of user inputs, specifically the 'fullname', 'location', and 'message' parameters submitted via POST to the endpoint '/ofrs/reporting.php'. A remote attacker could exploit this vulnerability by crafting malicious queries that compromise authenticated user sessions, potentially allowing the attacker to obtain sensitive cookie details.

References