PT-2026-1980 · Phpgurukul · Phpgurukul Staff Leave Management System

Hackerfactory · Published 2026-01-08 · Updated 2026-01-23 · CVE-2026-0730

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Staff Leave Management System version 1.0

Description A flaw exists in PHPGurukul Staff Leave Management System 1.0 related to cross-site scripting. The issue is located in the ADD STAFF/UPDATE STAFF function within the /staffleave/slms/slms/adminviews.py file, specifically within the SVG File Handler component. Manipulation of the profile pic argument can trigger the issue. The attack can be executed remotely, and an exploit has been published.

Recommendations PHPGurukul Staff Leave Management System version 1.0: As a temporary workaround, consider restricting access to the ADD STAFF/UPDATE STAFF function until a patch is available.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-0730

Affected Products

Phpgurukul Staff Leave Management System

References · 13

• 🔥 https://github.com/rsecroot/Staff-Leave-Management-System/blob/main/Cross%20Site%20Scripting.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0730 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0730 · Vendor Advisory
• https://twitter.com/letsexploit/status/2014639273106927896 · Twitter Post
• https://twitter.com/letsexploit/status/2009555288043454661 · Twitter Post
• https://twitter.com/letsexploit/status/2013212346269729075 · Twitter Post
• https://vuldb.com/?id.340127 · Note
• https://vuldb.com/?submit.733160 · Note
• https://twitter.com/VulmonFeeds/status/2009423856914534661 · Twitter Post
• https://phpgurukul.com · Note
• https://vuldb.com/?ctiid.340127 · Note
• https://t.me/CVEtracker/41777 · Telegram Post
• https://twitter.com/CVEnew/status/2009462329344409676 · Twitter Post