Cross-Site Scripting in phpgurukul Hostel Management System from phpgurukul
CVE-2025-63611

8.7HIGH

Key Information:

Vendor

phpgurukul
Status
Hostel Management System
Vendor
CVE Published:
8 January 2026

What is CVE-2025-63611?

The phpgurukul Hostel Management System v2.1 suffers from a Cross-Site Scripting vulnerability that occurs when user-submitted complaint fields are stored without proper escaping. Specifically, the input from the complaint submissions via /register-complaint.php is not sanitized and gets rendered in the admin interface at /admin/complaint-details.php?cid=. This flaw allows an attacker to inject malicious HTML or JavaScript, which executes in the administrator's browser when the complaint details are viewed, potentially compromising sensitive data or enabling unauthorized actions.

References

https://phpgurukul.com/hostel-management-system/
https://medium.com/@tanushkushtk01/cve-2025-63611-stored-...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.