CVE-2024-46335
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php. Input is not properly sanitized.
Risk Assessment
An attacker can inject malicious script executed in the victim's browser, enabling session or credential theft. This may result in unauthorized access to the system.
Recommendation
Update the application or implement validation and sanitization of the fromdate and todate parameters. Deploying a Content-Security-Policy header is also recommended.
Other vulnerabilities in PHPGurukul Complaint Management System
See all- CVE-2026-75089High
A weakness has been identified in PHPGurukul Complaint Management System 1.0, affecting the file user/check_availability.php. Manipulation of the argument email causes SQL injection. Remote exploitation is possible and the exploit has been made public.
- CVE-2024-44658Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.
- CVE-2024-44655Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php. Improperly sanitized input allows injection of malicious script.
- CVE-2024-44654Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.
Original NVD description (English source)
PHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS