The phpgurukul Complaint Management System version 2.0 contains a client‑side vulnerability that allows injection of arbitrary script code through the categoryName field in admin/subcategory.php, producing a stored or reflected XSS flaw. An attacker could exploit this to run malicious JavaScript in the context of an admin or any authenticated user who views the affected page. The weakness is classified as CWE‑79.

This vulnerability impacts phpgurukul Complaint Management System version 2.0. The flaw exists in the admin/subcategory.php page and affects any user who can access that page. It is not limited to a particular module beyond the admin interface; any user with access to that page is at risk.

The CVSS base score of 7.2 indicates high severity and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The flaw is not currently listed in the CISA KEV catalog. Successful use of this flaw would enable arbitrary JavaScript execution in the victim’s browser, which could lead to session hijacking, data theft, or defacement of the interface. The attack vector is an HTTP request to admin/subcategory.php, implying that the attacker must be able to reach the web application, a condition typical for publicly exposed sites.