Phpgurukul vulnerabilities, page 2
1,122 vulnerabilities
Known vulnerabilities in Phpgurukul products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 101 products.
CVE-2021-27545phpgurukulbeauty_parlour_management_system
EPSS score1.96%
SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sensitive database information by injecting SQL commands into the "sername" parameter.CVE-2021-27822phpgurukulvehicle_parking_management_systemEPSS score0.61%
A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Category field.CVE-2021-46110phpgurukulonline_shopping_portalEPSS score1.14%
Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.CVE-2021-44965phpgurukulemployee_record_management_systemEPSS score2.30%
Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retrieve and download sensitive information from the vulnerable server.CVE-2021-44315phpgurukulbus_pass_management_systemEPSS score1.74%
In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.CVE-2021-44966phpgurukulemployee_record_management_systemEPSS score2.15%
SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system.CVE-2021-44317phpgurukulbus_pass_management_systemEPSS score0.56%
In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.CVE-2021-28424phpgurukulteachers_record_management_systemEPSS score1.31%
A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in adminprofile.php.CVE-2021-28423phpgurukulteachers_record_management_systemEPSS score2.58%
Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in edit-subjects-detail.php, edit-teacher-detail.php, or the 'searchdata' POST parameter in search.php.CVE-2021-35388phpgurukulhospital_management_systemEPSS score0.46%
Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.CVE-2021-35387phpgurukulhospital_management_systemEPSS score0.85%
Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.CVE-2021-33470phpgurukulcovid19_testing_management_systemEPSS score2.27%
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.CVE-2021-33469phpgurukulcovid19_testing_management_systemEPSS score0.66%
COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.CVE-2025-63955phpgurukulstudent_record_systemEPSS score0.24%
A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into submitting a forged request. This leads to the unauthorized deletion of user accounts, causing a Denial of Service (DoS).CVE-2025-63611phpgurukulhostel_management_systemEPSS score0.31%
Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.CVE-2025-40694phpgurukulonline_fire_reporting_systemEPSS score0.21%
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.CVE-2025-40691phpgurukulonline_fire_reporting_systemEPSS score0.33%
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via
'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'.CVE-2025-40695phpgurukulonline_fire_reporting_systemEPSS score0.21%
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.CVE-2025-40692phpgurukulonline_fire_reporting_systemEPSS score0.33%
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via
'requestid' parameter in the endpoint '/ofrs/details.php'.CVE-2025-40690phpgurukulonline_fire_reporting_systemEPSS score0.33%
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.