CVE-2024-44655
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php. Improperly sanitized input allows injection of malicious script.
Risk Assessment
An attacker can execute malicious JavaScript in the user's browser, potentially stealing session or login data. This may lead to account takeover of an administrator or user.
Recommendation
Update the application to a non-vulnerable version or implement input validation and sanitization. Consider deploying a Content-Security-Policy header.
Other vulnerabilities in PHPGurukul Complaint Management System
See all- CVE-2026-75089High
A weakness has been identified in PHPGurukul Complaint Management System 1.0, affecting the file user/check_availability.php. Manipulation of the argument email causes SQL injection. Remote exploitation is possible and the exploit has been made public.
- CVE-2024-46335Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php. Input is not properly sanitized.
- CVE-2024-44658Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.
- CVE-2024-44654Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.
Original NVD description (English source)
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS