CVE-2025-70891

A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. The application does not properly sanitize or encode user-supplied input submitted via the uadd parameter in the add-users.php endpoint. An authenticated attacker can inject arbitrary JavaScript code that is persistently stored in the database. The malicious payload is triggered when a privileged user clicks the View button on the view-allusers.php page.

• CWE-79

• https://github.com/efekaanakkar/Cyber-Cafe-Management-System-CVEs/tree/main/CVE-2025-70891Exploit, Mitigation, Third Party Advisory
• https://phpgurukul.com/cyber-cafe-management-system-using-php-mysqlProduct

Published

Jan 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7088A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-70886An issue in halo v.2.22.4 and before allows a remote attacke…7.5
• CVE-2025-70887An issue in ralphje Signify before v.0.9.2 allows a remote a…8.8
• CVE-2025-70888An issue in mtrojnar Osslsigncode affected at v2.10 and befo…9.8
• CVE-2025-7089A vulnerability was found in Belkin F9K1122 1.00.33 and clas…8.8
• CVE-2025-70890A stored cross-site scripting (XSS) vulnerability exists in …6.1
• CVE-2025-70892Phpgurukul Cyber Cafe Management System v1.0 contains a SQL …9.8
• CVE-2025-70893A time-based blind SQL Injection vulnerability exists in PHP…8.8
• CVE-2025-70899PHPgurukul Online Course Registration v3.1 lacks Cross-Site …6.5
• CVE-2025-7090A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-7091A vulnerability was found in Belkin F9K1122 1.00.33. It has …8.8
• CVE-2025-7092A vulnerability has been found in Belkin F9K1122 1.00.33 and…8.8