Multiple cross‑site scripting (XSS) vulnerabilities exist in the /admin/edit‑vehicle.php component of Phpgurukul Vehicle Record Management System version 1.0. Attackers can inject crafted payloads into the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters to execute arbitrary web scripts or HTML. This enables malicious actors to run arbitrary client‑side code within the context of the application, potentially leading to data theft, credential compromise or defacement.

The vulnerability affects Phpgurukul Vehicle Record Management System at version 1.0, as identified by the component path and CPE string. No other versions or products are explicitly mentioned, so the impact is limited to installations running that exact version.

With a CVSS score of 4.8, the vulnerability is classified as medium severity. The EPSS score of below 1 % indicates a low likelihood of widespread exploitation, and the issue is not listed in the CISA KEV catalog. The vulnerability is likely exploitable by submitting crafted HTTP requests to the protected /admin interface, typically requiring authenticated access or at least access to the edit‑vehicle page. Attackers can leverage the unescaped input fields to inject malicious scripts that run in end‑user browsers.