CVE-2025-40694

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
5.1MEDIUM
EPSS
0.0%
top 89.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Phpgurukul Online Fire Reporting System
Timeline
PublishedSep 11

Description

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-p2cr-7737-pf4v: Stored Cross Site Scripting in Online Fire Reporting System v1↗2025-09-11
▶
CVEList
Cross Site Scripting in PHPGurukul Online Fire Reporting System↗2025-09-11
▶
CVE-2025-40694 (MEDIUM CVSS 5.1) | Stored Cross Site Scripting in Onli | cvebase.io