A local attacker can cause PHPRunner to crash by submitting an excessively long string in the dashboard name field during dashboard creation. The resulting application crash leads to interruption of service and loss of availability for any users relying on that instance.

The vulnerability affects Xlinesoft PHPRunner 10.1. It may also impact earlier releases such as 4.2 since the same input field is present, but only 10.1 is confirmed. The issue is limited to systems running the affected version of PHPRunner and requires a locally authenticated user with UI access to create dashboards.

The CVSS score of 6.9 indicates moderate severity, with no publicly available exploitation code (EPSS not available) and not listed in the CISA KEV catalog. The attack requires local access to the web interface and is limited to user-initiated input. While the exploit is unlikely to allow remote code execution, it can repeatedly render the application unusable, creating a practical denial of service risk for businesses deploying PHPRunner.