The vulnerability is a stored cross‑site scripting flaw in the /admin/add-brand.php page of the Vehicle Record Management System. An attacker can embed JavaScript or HTML into the brandname field; when an administrator submits the value, it is stored without proper escaping and subsequently rendered to users. This flaw allows arbitrary script execution within any victim's browser session that views the affected page, potentially leading to session hijacking, credential theft, or defacement of the website.

The affected product is the Phpgurukul Vehicle Record Management System, version 1.0. No other vendors or products are identified. The flaw exists only in this specific version unless newer releases address the issue.

The CVSS score of 4.8 indicates a moderate risk level, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the admin interface, implying that an attacker must be authenticated as an administrator or already possess a valid admin session. Once that condition is met, the attacker can inject malicious payloads into the brandname field, which are stored and later served to any user who views the brand record. The primary attack vector is a web-based form that accepts user-supplied data without proper sanitization.