CVE-2026-3402: XSS in PHPGurukul Student Record Management System

The XSS vulnerability in PHPGurukul Student Record Management System allows an attacker to inject arbitrary JavaScript code into the application's web pages. This code can then be executed in the context of a victim's browser when they visit a compromised page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application. The attack is remotely exploitable, meaning an attacker doesn't need to be on the same network as the server. Given the nature of XSS, the potential impact extends to any user interacting with the vulnerable page, potentially compromising sensitive data or system access.

1. Reserved2026-03-01
2. Published2026-03-02
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-3402 is to upgrade to a patched version of PHPGurukul Student Record Management System. Since a fixed version is not specified, thoroughly review the vendor's security advisories and release notes for the latest updates. As a temporary workaround, implement strict input validation and output encoding on the 'Course Short Name' parameter in /edit-course.php to sanitize user-supplied data. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests. Regularly scan the application for XSS vulnerabilities using automated tools.