CVE-2025-40693mediumCWE-79

CVE-2025-40693: falha de média gravidade em PHPGurukul Online Fire Reporting System

Cross Site Scripting in PHPGurukul Online Fire Reporting System

Publicada em

Seguir esta CVE+ Monitorar Online Fire Reporting System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.2%
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname' parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Produtos afetados
PHPGurukul · Online Fire Reporting System
CVEs relacionadas — PHPGurukul Online Fire Reporting System

No mesmo produto, das mais perigosas para as menos.

CVE-2025-3240MEDIUMPHPGurukul Online Fire Reporting System search.php sql injectionEPSS 0.6%CVE-2025-3239MEDIUMPHPGurukul Online Fire Reporting System edit-guard-detail.php sql injectionEPSS 0.6%CVE-2025-3238MEDIUMPHPGurukul Online Fire Reporting System search-request.php sql injectionEPSS 0.6%CVE-2025-5618MEDIUMPHPGurukul Online Fire Reporting System edit-team.php sql injectionEPSS 0.5%CVE-2025-5617MEDIUMPHPGurukul Online Fire Reporting System manage-teams.php sql injectionEPSS 0.5%CVE-2025-5613MEDIUMPHPGurukul Online Fire Reporting System request-details.php sql injectionEPSS 0.5%