CVE-2025-63611: XSS

Published Jan 8, 2026

Updated

Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.

Affected Software

2 affected components

Phpgurukul Hostel Management System=2.1

Event History

Jan 8, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-63611?

CVE-2025-63611 is classified as a moderate severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2025-63611?

To fix CVE-2025-63611, sanitize and escape user inputs in the complaint fields before rendering them in the admin interface.

Who is affected by CVE-2025-63611?

Users of phpgurukul Hostel Management System version 2.1 are affected by CVE-2025-63611.

What type of vulnerability is CVE-2025-63611?

CVE-2025-63611 is a Cross-Site Scripting (XSS) vulnerability that allows injection of malicious scripts.

What are the impacts of CVE-2025-63611?

The impacts of CVE-2025-63611 include possible session hijacking, defacement, or redirecting administrators to malicious sites.