CVE-2025-28016: phpgurukul user_registration_\&_login_and_user_management_system Cross-site Scripting

Vulnerability summary

CVE-2025-28016 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in phpgurukul user_registration_\&_login_and_user_management_system. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-09-2025
   PublishedVulnerability first disclosed.
2. 30-09-2025
   Last modifiedVulnerability information updated.

Description

A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary JavaScript code via the fname, lname, and contact parameters.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.