CVE-2024-44647
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
XSS vulnerability may enable session cookie theft, user account takeover, or unauthorized actions on behalf of the victim, potentially leading to data confidentiality breaches.
Recommendation
Update to the latest version of the system or implement input validation and encoding mechanisms for the aremark parameter.
Other vulnerabilities in PHPGurukul Small CRM
See all- CVE-2026-90575Low
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.
- CVE-2024-44648Medium
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. An attacker can exploit this flaw to manipulate SQL queries.
- CVE-2025-50484High
In PHPGurukul Small CRM v3.0, improper session invalidation in /crm/change-password.php allows attackers to perform a session hijacking attack.
Original NVD description (English source)
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS