Administrator session theft via stored name fields

Stored XSS in Phpgurukul User Registration & User Management System 2.0 allows remote attackers to execute script in an administrator's browser. The registration and user-edit handlers store unsanitized fname and lname values, and manage-users.php and update-profile.php render them without output encoding. No account is required to submit a payload, but execution requires an administrator to open the user listing or profile; the demonstrated consequence is administrator session-cookie theft.