CVE-2024-3090

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/add-ambulance.php of the component Add Ambulance Page. The manipulation of the argument Ambulance Reg No/Driver Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258683.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
PHPGurukul	Emergency Ambulance Hiring Portal	1.0
phpgurukul	emergency_ambulance_hiring_portal	1.0

References

https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_authsxss.mdExploit
https://vuldb.com/?ctiid.258683Permissions Required, VDB Entry
https://vuldb.com/?id.258683Third Party Advisory, VDB Entry
https://vuldb.com/?submit.306964Third Party Advisory, VDB Entry
https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_authsxss.mdExploit
https://vuldb.com/?ctiid.258683Permissions Required, VDB Entry
https://vuldb.com/?id.258683Third Party Advisory, VDB Entry
https://vuldb.com/?submit.306964Third Party Advisory, VDB Entry

Timeline

Published: Mar 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-30915.4A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as problematic. Affected is an unknown CVE-2024-309154.3An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and CVE-2024-309167.1An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensi CVE-2024-309175.5An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensi CVE-2024-30925.4An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 befor CVE-2024-309207.4Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php CVE-2024-309215.4Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component CVE-2024-309229.8SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rende CVE-2024-309239.8SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Docu CVE-2024-309244.6Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.CVE-2024-309256.5Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component.CVE-2024-309264.6Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component.