A flaw has been identified in the Staff Leave Management System version 1.0 where the ADD_STAFF and UPDATE_STAFF functions in the adminviews.py module, part of the SVG File Handler component, allow an attacker to manipulate the profile_pic argument. This manipulation injects JavaScript that is executed by the victim’s browser, giving the attacker the ability to perform client‑side attacks such as session hijacking, defacement, or executing arbitrary code in the context of the application. The CVSS score of 4.8 indicates a moderate severity potential for client‑side compromise.

The vulnerability affects PHPGurukul’s Staff Leave Management System, specifically version 1.0. No other product versions are reported as impacted.

The EPSS score is below 1%, implying a low but non‑zero likelihood of exploitation. The vulnerability can be triggered remotely via crafted input, and an exploit has already been published. It is not listed in the CISA KEV catalog, indicating no confirmed large‑scale incidents yet. The moderate CVSS score combined with the remote attack vector places this flaw at a manageable but still noticeable risk, especially in environments with exposed user interfaces or where SVG uploads are allowed.