This vulnerability affects PHPGurukul Company Visitor Management System 2.0. The issue is a cross-site scripting (XSS) flaw caused by insufficient sanitization of the 'fromdate' argument in the /bwdates-reports-details.php file. An attacker can remotely exploit this by manipulating the 'fromdate' parameter to inject malicious scripts, potentially impacting users who access the affected page. The CVSS 4.0 base score is 5.1, indicating medium severity. No official fix or patch has been published by the vendor as of the information provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity score and the requirement for user interaction (UI:P). There is no indication of privilege escalation or server-side compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the 'fromdate' parameter to mitigate XSS risks. Additionally, applying web application firewalls (WAF) rules that detect and block XSS payloads may help reduce exposure.