Stored script execution via unsanitized brand edit

Stored cross-site scripting in PHPGurukul Vehicle Record Management System 1.0 allows remote authenticated users to execute script via Brand Name. The /admin/edit-brand.php handler accepts an encoded script payload without adequate sanitization or validation, stores it, and renders it into a page; the public record disputes whether the underlying input is named phone_number or Brand Name. Administrator access is required to edit brands, and a victim must load the altered page for the script to execute in that browser context.