Medium severity · published Nov 24, 2025
CVE-2025-13577
PHPGurukul Hostel Management System register-complaint.php cross site scripting
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a manipulation of the argument cdetails can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
Hostel Management System · PHPGurukul
2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13577
Product
https://phpgurukul.com/
Permissions Required
https://vuldb.com/?ctiid.333341
Third Party Advisory
https://vuldb.com/?id.333341
Third Party Advisory
https://vuldb.com/?submit.698995
More from Hostel Management System
9.8
CVE-2025-6155
PHPGurukul Hostel Management System login-hm.inc.php sql injection
9.8
CVE-2025-6154
PHPGurukul Hostel Management System login.inc.php sql injection
9.8
CVE-2025-6153
PHPGurukul Hostel Management System students.php sql injection
9.8
CVE-2020-5510
PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file
9.1
CVE-2025-45953
A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component