CVE-2025-13577CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-13577

Low · published November 24, 2025

CVSS v3.1

3.5

EPSS

Percentile

11.5

In the wild

Unconfirmed

What it is

A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a manipulation of the argument cdetails can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 3.5 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00217 · 11.5th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-11-24T07:15Z

Affected products (1)

Product	Versions	Fixed in
phpgurukul/hostel_management_system	all versions	—

References (4)

https://phpgurukul.com/ · [email protected]https://vuldb.com/?ctiid.333341 · [email protected]https://vuldb.com/?id.333341 · [email protected]https://vuldb.com/?submit.698995 · [email protected]

EPSS history

Timeline

24 NOV 01:32Z
PHPGurukul Hostel Management System register-complaint.php cross site scripting
cvelistv5