Vulnerability · Published Sep 11, 2025 · Assigned by INCIBE
CVE-2025-40695Cross Site Scripting in PHPGurukul Online Fire Reporting System
Medium 5.1
In plain English
A medium-severity cross-site scripting in Online Fire Reporting System from PHPGurukul. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPGurukul | Online Fire Reporting System | 1.2 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N