A stored cross‑site scripting vulnerability in the admin/profile.php component allows attackers to inject crafted payloads into the Name parameter. The injected code is saved and later rendered to users, enabling the execution of arbitrary web scripts or HTML. This can lead to session hijacking, defacement, or phishing attacks against users who view the affected page. The weakness is identified as CWE‑79, indicating improper input validation and output encoding.

Phpgurukul Vehicle Record Management System version 1.0 is affected. No other vendors or products are listed as impacted.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request that injects a payload into the Name field, which is then stored and displayed to other users. The attack requires a write‑access to the Name field, possibly through authenticated use of the admin interface.