This vulnerability affects PHPGurukul Daily Expense Tracker System version 1.1. It arises from improper handling of the FullName parameter in the /dets/includes/sidebar.php file, which can be manipulated to inject malicious scripts leading to cross-site scripting (XSS). The vulnerability is remotely exploitable without requiring user interaction but does require low privileges (PR:L) and user interaction (UI:P) to trigger. The CVSS 4.0 base score is 5.1, indicating medium severity. Exploit code has been published, increasing the risk of potential attacks.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The vulnerability requires low privileges and user interaction to exploit. There is no indication of privilege escalation or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization workarounds on the FullName parameter if possible. Monitoring for updates from PHPGurukul is recommended.