CVE-2025-70891: XSS
A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. The application does not properly sanitize or encode user-supplied input submitted via the uadd parameter in the add-users.php endpoint. An authenticated attacker can inject arbitrary JavaScript code that is persistently stored in the database. The malicious payload is triggered when a privileged user clicks the View button on the view-allusers.php page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70891?
The severity of CVE-2025-70891 is classified as high due to the potential impact of stored cross-site scripting attacks.
How do I fix CVE-2025-70891?
To fix CVE-2025-70891, ensure proper sanitization and encoding of user inputs in the user management module of Phpgurukul Cyber Cafe Management System v1.0.
Who is affected by CVE-2025-70891?
Users of Phpgurukul Cyber Cafe Management System version 1.0 are affected by CVE-2025-70891.
What could an attacker do with CVE-2025-70891?
An attacker exploiting CVE-2025-70891 can execute malicious scripts in the context of the victim's browser, potentially compromising sensitive information.
Is CVE-2025-70891 remotely exploitable?
Yes, CVE-2025-70891 is remotely exploitable, as it can be triggered by an authenticated user submitting malicious input.