PT-2026-1980 · Phpgurukul · Phpgurukul Staff Leave Management System

Hackerfactory · Publicado 2026-01-08 · Atualizado 2026-01-23 · CVE-2026-0730

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Staff Leave Management System version 1.0

Description A flaw exists in PHPGurukul Staff Leave Management System 1.0 related to cross-site scripting. The issue is located in the ADD STAFF/UPDATE STAFF function within the /staffleave/slms/slms/adminviews.py file, specifically within the SVG File Handler component. Manipulation of the profile pic argument can trigger the issue. The attack can be executed remotely, and an exploit has been published.

Recommendations PHPGurukul Staff Leave Management System version 1.0: As a temporary workaround, consider restricting access to the ADD STAFF/UPDATE STAFF function until a patch is available.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2026-0730

Produtos afetados

Phpgurukul Staff Leave Management System

Referências · 13

• 🔥 https://github.com/rsecroot/Staff-Leave-Management-System/blob/main/Cross%20Site%20Scripting.md · Exploit
• https://twitter.com/letsexploit/status/2014639273106927896 · Publicação no Twitter
• https://twitter.com/letsexploit/status/2009555288043454661 · Publicação no Twitter
• https://twitter.com/letsexploit/status/2013212346269729075 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0730 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-0730 · Aviso do Fabricante
• https://vuldb.com/?id.340127 · Nota
• https://vuldb.com/?submit.733160 · Nota
• https://twitter.com/VulmonFeeds/status/2009423856914534661 · Publicação no Twitter
• https://phpgurukul.com · Nota
• https://vuldb.com/?ctiid.340127 · Nota
• https://t.me/CVEtracker/41777 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009462329344409676 · Publicação no Twitter