Medium severity · published Mar 2, 2026
CVE-2026-3402
PHPGurukul Student Record Management System edit-course.php cross site scripting
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-course.php. Such manipulation of the argument Course Short Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
Student Record Management System · PHPGurukul
1.0 · source: vendor
SR
Student Record System · Phpgurukul
1.0 · source: NVD
Affected product
SR
Student Record Management System
PHPGurukul
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3402
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3402
Exploit
https://github.com/AS-AbdulSamad/CVEs/issues/2
Product
https://phpgurukul.com/
Permissions Required
https://vuldb.com/?ctiid.348297
Third Party Advisory
https://vuldb.com/?id.348297
Third Party Advisory
https://vuldb.com/?submit.763323
More from Student Record Management System
4.8
CVE-2026-3403
PHPGurukul Student Record Management System edit-subject.php cross site scripting