Online Fire Reporting System v1.2 XSS via edit-team.php
CVE-2025-40693 Published on September 11, 2025

Cross Site Scripting in PHPGurukul Online Fire Reporting System
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname' parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.

NVD

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2025-40693 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2025-40693

Want to know whenever a new CVE is published for PHPGurukul Online Fire Reporting System? stack.watch will email you.

PHPGurukul Online Fire Reporting System
 

Affected Versions

PHPGurukul Online Fire Reporting System Version 1.2 is affected by CVE-2025-40693

Exploit Probability

EPSS
0.03%
Percentile
9.02%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.