Stored XSS via unsanitized expense fields

Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.0 lets authenticated users inject script through manage-expense.php. The ExpenseItem and ExpenseCost parameters are persisted without adequate output encoding when expense records are rendered, allowing attacker-controlled markup to execute in a viewing session. Exploitation requires an authenticated account and a victim to open the affected expense view; the demonstrated impact is client-side script execution with confidentiality and integrity exposure in that session.