A stored cross‑site scripting flaw resides in the /admin/search-vehicle.php page of Phpgurukul Vehicle Record Management System version 1.0. The flaw allows attackers to inject malicious scripts via the Search parameter; those scripts are stored and later rendered by the server without escaping. When an administrator or any user views the search results, the browser interprets the injected code, potentially compromising session cookies, defacing the interface, or exfiltrating data. This weakness falls under CWE‑79, a typical stored input injection problem.

The vulnerability hits installations of Phpgurukul Vehicle Record Management System 1.0. Only systems running that exact version with access to the admin search feature are affected.

The CVSS base score of 6.1 indicates medium severity. The EPSS score of less than 1 % suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits yet. Likely attack requires access to the admin interface; if the interface is publicly reachable or an attacker can gain credentials, the stored script could be executed whenever a user loads the search results. If the admin area is well protected, the risk depends on the strength of authentication and the potential for credential compromise.