CVE-2026-90850 Details

A stored cross-site scripting vulnerability has been identified in PHPGurukul Hostel Management System version 3.0. The issue resides in several administrative management files, where user-controlled data is displayed without proper HTML encoding. This flaw allows attackers to inject JavaScript payloads that are executed when an administrator views the affected records. The vulnerability can be exploited remotely, with the injected scripts running in the context of the administrator's session.

To address this vulnerability, encode all database-backed output in administrative views using a consistent output-encoding helper or template escape function. Validate and constrain input on the server for fields like names and feedback, and apply a Content Security Policy that restricts script sources. Finally, audit all admin views that use raw 'echo' statements to ensure proper encoding before rendering.