CVE-2026-0730: PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting

Published Jan 8, 2026

Updated

A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADDSTAFF/UPDATESTAFF of the file /staffleave/slms/slms/adminviews.py of the component SVG File Handler. Executing a manipulation of the argument profilepic can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

Affected Software

2 affected components

Phpgurukul Staff Leave Management System

Phpgurukul Staff Leave Management System=1.0

Event History

Jan 8, 2026

CVE Published

via MITRE·10:02 PM

Data Sourced

via MITRE·10:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0730?

The severity of CVE-2026-0730 is classified as medium due to its potential to allow attackers to manipulate file uploads.

How do I fix CVE-2026-0730?

To fix CVE-2026-0730, ensure proper validation and sanitization of the profile_pic input in the ADD_STAFF and UPDATE_STAFF functions.

What vulnerability does CVE-2026-0730 expose?

CVE-2026-0730 exposes the system to potential cross-site scripting (XSS) attacks due to improper handling of SVG file uploads.

Which component is affected by CVE-2026-0730?

CVE-2026-0730 affects the SVG File Handler component in the PHPGurukul Staff Leave Management System.

Which version of PHPGurukul Staff Leave Management System is impacted by CVE-2026-0730?

CVE-2026-0730 impacts the PHPGurukul Staff Leave Management System version 1.0.