Vulnerability · Published Jan 8, 2026 · Assigned by VulDB

CVE-2026-0730PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in Staff Leave Management System from PHPGurukul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 79.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UPDATE_STAFF of the file /staffleave/slms/slms/adminviews.py of the component SVG File Handler. Executing a manipulation of the argument profile_pic can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
PHPGurukul	Staff Leave Management System	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-340127 | PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting vdb-entry, technical-description
VDB-340127 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #733160 | PHPGurukul Staff Leave Management System v1.0 Cross Site Scripting third-party-advisory
https://github.com/rsecroot/Staff-Leave-Management-System/blob/main/Cross%20Site%20Scripting.md exploit
https://phpgurukul.com/ product