CVE-2025-63611: Phpgurukul Hostel Management System

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.

Affected products

• Phpgurukul Hostel Management System: version 2.1 only

Published 2026-01-08. Last modified 2026-06-17.