The vulnerability resides in the manage-newvisitors.php page of PHPGurukul's Company Visitor Management System version 1.0. A malicious or manipulated fullname argument is processed without proper sanitization, allowing arbitrary HTML or JavaScript to be injected into the page. This leads to reflected cross‑site scripting (XSS), as specified by CWE‑79, and may involve improper neutralization of expression language elements (CWE‑94). An attacker can exploit this to steal session cookies, perform phishing, or load malicious payloads in affected users’ browsers.

The only documented affected product is PHPGurukul Company Visitor Management System, version 1.0, running on any platform where the manage‑newvisitors.php script is exposed. No other versions or vendor products were listed, so the scope is limited to installations of the 1.0 release.

The CVSS score of 4.8 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild yet. The attack vector is remote; an attacker can construct a URL or form submission to supply the malicious fullname value and trigger the reflected script in the victim’s browser. Without a remedial patch the exposed input remains vulnerable, making this a viable threat when web traffic reaches the vulnerable endpoint.