CVE-2025-10794

2.1 lowEPSS 0.4%

Low (2.1) in phpgurukul car rental project. EPSS 0.4% chance of exploitation in the next 30 days.

A flaw has been found in PHPGurukul Car Rental Project 3.0. Affected by this issue is some unknown functionality of the file /carrental/search.php. Executing manipulation of the argument autofocus can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2025-09-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpgurukul:car_rental_project

References

https://github.com/tddgns/cve/issues/1
https://phpgurukul.com/
https://vuldb.com/?ctiid.325151
https://vuldb.com/?id.325151
https://vuldb.com/?submit.654067

Check your stack JSON