The vulnerability exists in the bwdates‑reports‑details.php file of PHPGurukul Company Visitor Management System 2.0. An attacker can craft a request that manipulates the fromdate argument to inject unencoded HTML or JavaScript. When the victim’s browser processes the response, the injected script executes with the privileges of the page, potentially allowing session hijacking, defacement, or the theft of sensitive data within the browser. This flaw is a classic reflected XSS issue (CWE‑79).

PHPGurukul: Company Visitor Management System version 2.0 is the only product listed as affected. The exploit targets the bwdates‑reports‑details.php endpoint, and no other vendors or versions are indicated in the provided data.

The CVSS score of 5.1 denotes moderate severity. No EPSS data is available, and the vulnerability is not included in the CISA KEV catalog. The flaw can be exploited remotely by any attacker able to send a crafted HTTP request containing a malicious fromdate value. Authentication or privileged access is not required. The impact is confined to the client side, potentially compromising user sessions or data in the browser, but does not afford direct server‑side control.