CVE-2026-19207 Details

A stored cross-site scripting vulnerability has been identified in PHPGurukul Company Visitor Management System version 2.0. The issue arises in the file '/manage-newvisitors.php', where the 'fullname' parameter is processed without proper input validation or output encoding. This allows attackers to inject malicious JavaScript that is executed in the browsers of administrators viewing the visitor list. The vulnerability can be exploited by authenticated administrators, or by unauthenticated users who bypass login restrictions through a separate SQL injection vulnerability.

To address this vulnerability, implement proper output encoding for all data displayed in HTML contexts, using functions like htmlspecialchars. Additionally, validate and sanitize user input before storing it in the database, especially in fields that should only contain plain text. Consider adding a Content Security Policy to restrict script execution and set HttpOnly and Secure flags on session cookies to protect against cookie theft.