PT-2026-1840 · Phpgurukul · Hospital Management System

Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-63611

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpgurukul Hostel Management System version 2.1

Description The application stores user-provided complaint data, specifically the 'Explain the Complaint' field submitted through the /register-complaint.php endpoint, without proper output encoding. This allows for the injection of HTML and JavaScript code. When an administrator views complaint details via the /admin/complaint-details.php?cid=endpoint, the injected code executes in the administrator’s browser. Thecid` variable in the endpoint is used to identify the complaint.

Recommendations Apply appropriate output encoding or escaping mechanisms to the 'Explain the Complaint' field before storing and rendering it to prevent the execution of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63611

Affected Products

Hospital Management System

References · 6

• 🔥 https://medium.com/@tanushkushtk01/cve-2025-63611-stored-cross-site-scripting-xss-in-hostel-management-system-v2-1-a23c2efc86ea · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63611 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63611 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2009354644766790060 · Twitter Post
• https://twitter.com/CVEnew/status/2009300015861190686 · Twitter Post
• https://phpgurukul.com/hostel-management-system · Note