The PHPgurukul Complaint Management System 2.0 is vulnerable to a reflected Cross Site Scripting flaw located in the admin/userprofile.php page via the fullname parameter. Attackers can inject arbitrary script when the parameter is processed, potentially leading to session hijacking, credential theft, or defacement of the web interface. This weakness is categorized as CWE‑79.

This vulnerability affects PHPgurukul's Complaint Management System version 2.0. Administrators who can reach the admin/userprofile.php endpoint are potentially impacted. No other versions or products are listed as affected.

The CVSS base score of 8.8 classifies it as high severity. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated administrator supplying a malicious fullname string through the admin interface; if the system does not perform proper output encoding, the injected script can execute in a victim’s browser. Consequently, organizations should treat this as a high‑risk issue, especially if the admin portal is exposed to untrusted users or reachable via network edges.