CVE-2025-63611

High · 8.7

CVSS

8.7

EPSS

0.3%

Published

Jan 8, 2026

CISA due date

—

The record

Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an administrator opens the complaint, injected HTML/JavaScript executes in the admin's browser.

Affected packages

Ecosystem	Package	Introduced	Fixed