CVE-2026-3403

An attacker can inject malicious scripts into the PHPGurukul Student Record Management System through the Course Short Name field, potentially allowing them to steal sensitive information from users who visit the compromised page. This vulnerability can be exploited remotely, meaning the attacker doesn't need physical access to the system to carry out the attack.

This vulnerability allows an attacker to manipulate the database of the student management system by injecting harmful SQL code through the searchdata parameter, potentially exposing sensitive information or altering data. To exploit this, the attacker needs access to the search feature on the admin page.

An attacker can trick a logged-in user of the gym management system into unknowingly updating their profile information by sending them a malicious link. This vulnerability requires the user to be logged in and click on the link while visiting the attacker's site, potentially allowing the attacker to change the user's details without their consent.