Phpgurukul Hostel Management System vulnerabilities
17 vulnerabilities
Known vulnerabilities in Phpgurukul Hostel Management System, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-43137phpgurukulhostel_management_system
EPSS score0.53%
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.CVE-2025-63611phpgurukulhostel_management_systemEPSS score0.31%
Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.CVE-2025-13577phpgurukulhostel_management_systemEPSS score0.22%
A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a manipulation of the argument cdetails can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.CVE-2025-45953phpgurukulhostel_management_systemEPSS score0.44%
A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotelyCVE-2025-28129phpgurukulhostel_management_systemEPSS score0.22%
Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.CVE-2025-6153phpgurukulhostel_management_systemEPSS score0.51%
A vulnerability has been found in PHPGurukul Hostel Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/students.php. The manipulation of the argument search_box leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.CVE-2025-6154phpgurukulhostel_management_systemEPSS score0.51%
A vulnerability was found in PHPGurukul Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /includes/login.inc.php. The manipulation of the argument student_roll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.CVE-2025-6155phpgurukulhostel_management_systemEPSS score0.51%
A vulnerability was found in PHPGurukul Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /includes/login-hm.inc.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.CVE-2020-25270phpgurukulhostel_management_systemEPSS score3.19%
PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.CVE-2020-5510phpgurukulhostel_management_systemEPSS score2.11%
PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file.CVE-2026-90850phpgurukulhostel_management_systemEPSS score0.37%
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.CVE-2026-90851phpgurukulhostel_management_systemEPSS score0.37%
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.CVE-2023-36939phpgurukulhostel_management_systemEPSS score0.56%
Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the search booking field.CVE-2023-36375phpgurukulhostel_management_systemEPSS score0.87%
Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page.CVE-2023-36376phpgurukulhostel_management_systemEPSS score0.59%
Cross-Site Scripting (XSS) vulnerability in Hostel Management System v.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the add course section.CVE-2023-34652phpgurukulhostel_management_systemEPSS score0.49%
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.CVE-2023-34647phpgurukulhostel_management_systemEPSS score0.36%
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).