CVE-2026-6162: XSS in PHPGurukul Company Visitor Management System

Successful exploitation of CVE-2026-6162 allows an attacker to inject arbitrary JavaScript code into the web application. This code will then be executed in the context of the user's browser, potentially granting the attacker access to sensitive information like session cookies. An attacker could leverage this to impersonate legitimate users, perform actions on their behalf, or redirect them to malicious websites. The impact is amplified if the application handles sensitive data or integrates with other systems, as the attacker could potentially gain access to those resources as well. This vulnerability shares similarities with other XSS flaws where user-supplied input is not properly sanitized before being rendered in the browser.

1. Reserved2026-04-12
2. Published2026-04-13
3. EPSS updated2026-04-20

The primary mitigation for CVE-2026-6162 is to upgrade to a patched version of PHPGurukul Company Visitor Management System as soon as it becomes available. Until the patch is applied, implement temporary mitigations such as strict input validation on the 'fromdate' parameter in /bwdates-reports-details.php. This should include whitelisting allowed characters and formats, and rejecting any input that does not conform to the expected pattern. Additionally, implement robust output encoding to prevent the browser from interpreting the injected script as executable code. Consider using a Web Application Firewall (WAF) with XSS protection rules to filter out malicious requests.