CVE-2025-10794

A cross-site scripting (XSS) vulnerability has been identified in PHPGurukul Car Rental Project version 3.0. The flaw exists in the /carrental/search.php file, where the autofocus parameter is output directly into the HTML response without proper sanitization or encoding [2]. This allows an attacker to inject arbitrary JavaScript code.

Attackers can exploit this remotely by sending a crafted POST request to the search endpoint. While authentication requirements are unclear, the vulnerability is accessible to unauthenticated users if no session is enforced [2]. The parameter is reflected in a way that triggers script execution when the page is viewed.

Successful exploitation could lead to session hijacking, cookie theft, web page defacement, or phishing attacks, as the injected script runs in the context of the victim's browser [2]. The impact may affect both visitors and authenticated users.

The vulnerability has been publicly disclosed with a proof-of-concept exploit. As of the advisory, no official patch has been released by the vendor [1]. Users are advised to apply input sanitization or consider upgrading to a patched version if available.