Description Summary:
A SQL injection vulnerability exists in the register.php file of PHPGurukul Daily Expense Tracking System 1.1, allowing unauthenticated attackers to manipulate the email argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Daily Expense Tracking System 1.1 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-6193

Affected Software: PHPGurukul Daily Expense Tracking System

Affected Versions: 1.1

Vulnerability: This vulnerability is a SQL injection (CWE-89) located in the register.php file. Unauthenticated attackers can inject malicious SQL commands via the email parameter to interact with the backend database.

Business Impact

The CVSS score of 7.3 classifies this as a high-severity vulnerability due to the ease of remote exploitation. Successful exploitation could lead to unauthorized data exposure, potential modification of application data, or disruption of database services, resulting in significant reputational and operational impact.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the registration page or implement strict input validation to sanitize the email parameter before it is processed by the database.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous queries containing SQL syntax, particularly those directed at the register.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the email parameter in registration requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists and is documented in the referenced GitHub issue.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability presents a tangible risk to any organization running the affected software. Administrators must prioritize isolating the affected component and implementing robust input filtering to prevent exploitation until the vendor releases a secure update.

Description Summary:
A security vulnerability exists in PHPGurukul Beauty Parlour Management System 1, which could allow attackers to compromise the application's integrity and access sensitive data.

Executive Summary:
A high-severity vulnerability in PHPGurukul Beauty Parlour Management System 1 poses a significant risk to application integrity and sensitive data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-2088

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1

Vulnerability: A security flaw has been identified in the PHPGurukul Beauty Parlour Management System. While the specific authentication requirements are not explicitly detailed in the initial disclosure, the nature of the flaw suggests a vulnerability within the application's data handling or management interface.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to customer records, appointment data, and administrative functions. The CVSS score of 7.3 classifies this as a High-severity risk, indicating that a successful attack could result in significant reputational damage and the loss of sensitive business information.

Remediation Plan

Immediate Action: Apply the latest security updates provided by PHPGurukul immediately to mitigate the risk of exploitation.

Proactive Monitoring: Security teams should review web server access logs for unusual patterns or unauthorized attempts to access management directories.

Compensating Controls: Implementing a Web Application Firewall (WAF) can help detect and block common exploit payloads targeting this management system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its High-severity CVSS score, the potential for exploitation remains a significant concern for organizations running this software.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate remediation. Organizations should prioritize patching the PHPGurukul Beauty Parlour Management System to version 1 or higher as recommended by the vendor to ensure the continued security of their data and operations.

Description Summary:
PHPGurukul Directory Management System 1.0 contains a remote SQL injection vulnerability in the search function of the index.php file via the searchdata argument.

Executive Summary:
A remote SQL injection vulnerability in PHPGurukul Directory Management System 1.0 allows unauthenticated attackers to execute arbitrary database commands, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-1160

Affected Software: PHPGurukul Directory Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located within the search component of the index.php file. The application fails to properly sanitize the searchdata argument, allowing an unauthenticated attacker to manipulate database queries remotely.

Business Impact

Successful exploitation allows unauthorized actors to access, modify, or delete sensitive information contained within the application database. Given the CVSS score of 7.3, this high-severity flaw could lead to complete compromise of the underlying data layer, potential loss of user privacy, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected directory or disable the search functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous patterns in the searchdata parameter, such as SQL syntax characters (e.g., single quotes, semicolons, or comment indicators).

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the searchdata argument on index.php.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of January 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input provided to the search function is passed directly to the database engine without sufficient validation.

Analyst Recommendation

This vulnerability presents a clear and immediate risk to the confidentiality and integrity of the backend database. Organizations using PHPGurukul Directory Management System 1.0 must prioritize the implementation of WAF-based filtering or disable the vulnerable search feature immediately to prevent potential data breaches while awaiting an official security update.

Description Summary:
A SQL injection vulnerability exists in the Beauty Parlour Management System due to improper input sanitization of the viewid argument in the /admin/view-appointment.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System version 1.1 poses a significant risk of unauthorized database access and data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-9933

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is susceptible to SQL injection via the viewid parameter within the /admin/view-appointment.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, potentially leading to unauthorized data retrieval or modification.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive customer or administrative data stored within the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in a total compromise of the application data layer, potentially leading to reputational damage and loss of user trust.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/view-appointment.php endpoint and implement strict input validation for the viewid parameter.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax, such as UNION, SELECT, or comment characters, directed toward the administrative interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the vulnerability report at https://github.com/xiaoxinkaishi/cve/issues/4 and via the associated GitHub repository.

Analyst Notes: As of September 5, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit as it requires no authentication and targets a common administrative function.

Analyst Recommendation

The presence of a public proof-of-concept, combined with the lack of a vendor-provided patch, necessitates immediate manual intervention to secure the affected system. Organizations should prioritize isolating the vulnerable component and implementing compensating controls to prevent unauthorized database access until an official update is released.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate the lid argument in /admin/update-image.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 poses a significant risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-9932

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This vulnerability is a SQL injection flaw located in the /admin/update-image.php file. The application fails to properly sanitize the lid argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data disclosure, modification, or deletion. With a CVSS score of 7.3, this flaw is considered High severity, as it provides an unauthenticated entry point that could compromise the integrity and confidentiality of the entire application backend.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory using IP whitelisting or by requiring an additional layer of authentication at the web server level.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/update-image.php, specifically looking for unusual patterns in the lid parameter that resemble SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads to mitigate the risk of exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of September 5, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with a critical administrative file.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a clear and present danger to affected systems. Organizations running PHPGurukul Beauty Parlour Management System 1.1 must implement the suggested compensating controls immediately and continue to monitor for official vendor guidance or security updates.

Description Summary:
A SQL injection vulnerability in the Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to execute arbitrary database queries via the sername parameter in edit-services.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 poses a critical risk of complete database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-9831

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/edit-services.php file. An unauthenticated attacker can inject malicious SQL commands through the sername POST parameter, which is processed without sufficient sanitization.

Business Impact

Successful exploitation allows an attacker to bypass authentication, extract sensitive information from the backend database, modify or delete critical business data, and potentially gain full control over the application environment. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and loss of data confidentiality.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict network access to the application and implement strict input validation for the /admin/edit-services.php endpoint.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests containing SQL syntax or time-based sleep commands targeting the edit-services.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters to provide a virtual patch until the source code is remediated.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

Analyst Notes: As of September 3, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

Due to the lack of an official patch and the availability of public exploit documentation, this vulnerability presents an immediate risk. Organizations utilizing PHPGurukul Beauty Parlour Management System 1.1 must prioritize the implementation of compensating controls, such as WAF filtering, and should consider isolating the application from external networks until a secure version is released.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to execute arbitrary database queries via the sids[] parameter.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 exposes the underlying database to unauthorized access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-9830

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/add-customer-services.php file. The application fails to sanitize the sids[] parameter, allowing an unauthenticated remote attacker to manipulate SQL queries executed against the backend database.

Business Impact

Successful exploitation allows an attacker to bypass authentication, extract sensitive information, modify or delete database records, and potentially achieve full control over the application environment. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, which could result in severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative interface and implement strict input validation on the affected file.

Proactive Monitoring: Security teams should review server access logs for anomalous POST requests to /admin/add-customer-services.php, specifically monitoring for SQL syntax patterns or time-based blind injection payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, particularly those targeting the sids[] parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's write-up on GitHub.

Analyst Notes: As of September 3, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

The presence of a functional proof-of-concept increases the likelihood of opportunistic exploitation. Organizations using this software must treat this as a high-priority risk. Until the vendor provides a secure update, ensure that the application is isolated from public-facing networks and that database permissions are restricted to the absolute minimum necessary for operation.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the mobilenumber parameter in signup.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 poses a critical risk of full database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-9829

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application fails to properly sanitize user-supplied input within the mobilenumber parameter of the /signup.php file. This flaw allows an unauthenticated attacker to inject malicious SQL queries, enabling unauthorized database manipulation and potential data exfiltration.

Business Impact

The ability to perform SQL injection without authentication represents a severe security failure that could lead to the total compromise of the application database. Successful exploitation may result in the exfiltration of sensitive customer or administrative information, unauthorized modification of records, and potential disruption of business services. Given the CVSS score of 7.3, this vulnerability is categorized as High severity and requires immediate attention to prevent data breach or system takeover.

Remediation Plan

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the /signup.php endpoint or disable the registration feature until the vendor provides a secure update.

Proactive Monitoring: Review database access logs for anomalous query patterns, specifically those containing SQL syntax characters or time-based delay commands, such as SLEEP() or BENCHMARK().

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the mobilenumber parameter in POST requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked GitHub issue.

Analyst Notes: As of September 3, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability significantly lowers the barrier for exploitation by malicious actors. Organizations utilizing PHPGurukul Beauty Parlour Management System 1.1 must prioritize the implementation of WAF filtering or access restrictions immediately. We strongly recommend monitoring for vendor security updates and applying the official fix as soon as it becomes available to ensure long-term system integrity.

Description Summary:
A SQL injection vulnerability in the Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to manipulate database queries via the mobnumber parameter in /admin/contact-us.php.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated attackers to execute unauthorized database operations and potentially gain full system control.

Vulnerability Details

CVE-ID: CVE-2025-9814

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/contact-us.php file. An unauthenticated attacker can inject malicious SQL commands via the mobnumber POST parameter, which is processed by the backend without sufficient sanitization or validation.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication, extract sensitive information, modify or delete database contents, and potentially achieve full control over the underlying server. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality, integrity, and availability, which could lead to severe operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should immediately restrict access to the /admin/contact-us.php endpoint or disable the affected functionality entirely until a vendor-supplied fix is released.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to /admin/contact-us.php, specifically searching for SQL syntax patterns or time-based blind injection indicators such as the SLEEP function.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the mobnumber parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of September 3, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to execute.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly increases the risk of automated exploitation. Organizations utilizing PHPGurukul Beauty Parlour Management System 1.1 must prioritize implementing the suggested compensating controls and monitoring measures immediately to prevent unauthorized database access while awaiting a formal security update from the vendor.

Description Summary:
A SQL injection vulnerability in PHPGurukul Online Course Registration 3.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the sesssion parameter in /admin/session.php.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Online Course Registration 3.1 allows unauthenticated remote attackers to compromise the backend database and potentially gain full system control.

Vulnerability Details

CVE-ID: CVE-2025-9307

Affected Software: PHPGurukul Online Course Registration

Affected Versions: 3.1

Vulnerability: The application is vulnerable to SQL injection due to insufficient sanitization of the sesssion parameter within the /admin/session.php script. This flaw allows an unauthenticated attacker to manipulate backend database queries remotely.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, leading to potential data exfiltration, modification, or deletion of sensitive course and user information. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete system compromise and significant operational disruption, threatening the integrity and confidentiality of the entire registration platform.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators must restrict access to the /admin/session.php endpoint at the web server level until a permanent fix is released.

Proactive Monitoring: Monitor database query logs for unusual time-based patterns or syntax errors that indicate automated SQL injection attempts, particularly originating from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the sesssion parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in a GitHub repository linked by the vulnerability record.

Analyst Notes: As of August 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger the flaw.

Analyst Recommendation

The presence of a public proof-of-concept significantly lowers the barrier for attackers to exploit this vulnerability. Organizations should prioritize implementing WAF-based filtering or restricting network access to the affected administrative file immediately to mitigate the risk of unauthorized database access. Monitor vendor communications closely for the release of an official security update and apply it as soon as it becomes available.

Description Summary:
A SQL injection vulnerability in the signup.php file of PHPGurukul User Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the emailid parameter.

Executive Summary:
The PHPGurukul User Management System 1.0 is vulnerable to an unauthenticated SQL injection attack that could lead to full database compromise.

Vulnerability Details

CVE-ID: CVE-2025-9302

Affected Software: PHPGurukul User Management System in PHP using Stored Procedure

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw located in the signup.php script. The application fails to sanitize the emailid parameter before using it in database queries, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries against the backend database. This could result in the unauthorized extraction of sensitive user data, modification or deletion of records, and potential full system control, which carries significant risks regarding data confidentiality, integrity, and regulatory compliance. The CVSS score of 7.3 reflects the high risk posed by this remotely exploitable, unauthenticated vulnerability.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the signup.php endpoint via network controls or authentication proxies until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to signup.php, particularly those containing SQL syntax characters like single quotes, comments, or RLIKE keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the emailid field.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept payload and technical details are available via the researcher report on GitHub.

Analyst Notes: As of August 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input validation on a publicly accessible signup form.

Analyst Recommendation

Given the availability of public exploit details and the ease of exploitation, this vulnerability poses a significant risk to any organization using the affected PHPGurukul software. Administrators must prioritize isolating the affected component and implementing WAF protections immediately. Until the vendor provides a secure update, consider the application unsafe for public-facing deployments.

Description Summary:
A SQL injection vulnerability in the PHPGurukul Online Shopping Portal Project version 2.0 allows unauthenticated attackers to execute blind SQL injection attacks via search parameters.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Online Shopping Portal Project 2.0 poses a severe risk of unauthorized database access and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-9012

Affected Software: PHPGurukul Online Shopping Portal Project

Affected Versions: 2.0

Vulnerability: This is a SQL Injection (CWE-89) vulnerability where the application fails to properly sanitize search input, allowing an unauthenticated remote attacker to manipulate database queries.

Business Impact

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to the unauthorized disclosure or modification of sensitive information. Given the CVSS score of 9.3, this flaw represents a significant risk to data integrity and confidentiality that could result in full database compromise.

Remediation Plan

Immediate Action: Upgrade to the latest version of the PHPGurukul Online Shopping Portal Project as soon as a patch is made available by the vendor.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, such as unusual characters or SQL syntax commonly used in injection attacks (e.g., UNION, SELECT, OR 1=1).

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection payloads targeting search parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of 2025-07-20, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for unauthenticated, automated exploitation.

Analyst Recommendation

This vulnerability is highly critical due to the ease of exploitation. Administrators must prioritize the application of vendor updates to remediate this flaw and prevent potential database-level compromise.

Description Summary:
PHPGurukul Hospital Management System 4.0 is vulnerable to remote SQL injection via the docfees argument in the /admin/edit-doctor.php file, allowing unauthorized database interaction.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Hospital Management System 4.0 allows unauthenticated remote attackers to manipulate database queries, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-8955

Affected Software: PHPGurukul Hospital Management System

Affected Versions: 4.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) occurring within the /admin/edit-doctor.php file. The vulnerability is triggered by an unauthenticated attacker manipulating the docfees argument.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the theft or modification of sensitive patient records. With a CVSS score of 7.3, this high-severity flaw represents a substantial risk to organizational data confidentiality and compliance requirements, as it allows for remote, unauthenticated interaction with the backend database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements to prevent external exploitation.

Proactive Monitoring: Monitor database query logs for anomalous patterns, such as unexpected SQL syntax characters or unauthorized attempts to access the doctor information tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the docfees parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up at the provided GitHub reference.

Analyst Notes: As of August 15, 2025, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote interaction with the database.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently running version 4.0 of the PHPGurukul Hospital Management System should prioritize implementing the suggested compensating controls and strictly limit network exposure until a permanent vendor patch is released.

Description Summary:
PHPGurukul Hospital Management System 4.0 contains a SQL injection vulnerability in the doctorspecilization parameter within the admin/doctor-specilization.php file, allowing remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Hospital Management System 4.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-8954

Affected Software: PHPGurukul Hospital Management System

Affected Versions: 4.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the doctorspecilization argument of the admin/doctor-specilization.php endpoint, which can be triggered by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to read, modify, or delete sensitive data stored in the hospital management database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to unauthorized access to patient records and administrative credentials.

Remediation Plan

Immediate Action: As no official patch is currently identified, restrict access to the affected /admin/ directory using IP allowlisting or VPN requirements until a vendor-supplied update is available.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /admin/doctor-specilization.php file, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming traffic.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub reference provided in the vulnerability disclosures.

Analyst Notes: As of August 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of authentication required to exploit this flaw makes it a significant risk. Administrators should immediately implement network-level access controls to shield the administrative interface from the public internet. Monitor vendor channels closely for an official security patch and apply it as soon as it is released.

Description Summary:
PHPGurukul Teachers Record Management System 2.1 is vulnerable to remote SQL injection via the searchdata argument in the /admin/search.php file, allowing for unauthorized database interaction.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Teachers Record Management System 2.1 exposes the underlying database to remote, unauthenticated exploitation.

Vulnerability Details

CVE-ID: CVE-2025-8951

Affected Software: PHPGurukul Teachers Record Management System

Affected Versions: 2.1

Vulnerability: The application fails to properly sanitize user input in the searchdata parameter within the /admin/search.php file. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the database.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could lead to unauthorized data exfiltration, modification of records, or potential disruption of service, resulting in significant reputational damage and loss of data integrity for the organization.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/search.php endpoint or disable the affected search functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual query patterns targeting the searchdata parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept has been disclosed via a research entry on GitHub.

Analyst Notes: As of August 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

Given the availability of a public proof of concept and the relative ease of exploitation, this vulnerability poses a significant risk to any environment running the affected software. Security teams must prioritize identifying instances of this application and implementing the recommended network-level restrictions immediately to prevent unauthorized database access.

Description Summary:
A SQL injection vulnerability exists in the PHPGurukul Boat Booking System 1.0 via the boatname parameter in /admin/add-boat.php, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Boat Booking System 1.0 allows unauthenticated remote attackers to compromise the underlying database, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-8431

Affected Software: PHPGurukul Boat Booking System

Affected Versions: 1.0

Vulnerability: This is a SQL injection (CWE-89) flaw located in the /admin/add-boat.php file. The application fails to sanitize the boatname parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands directly into the database.

Business Impact

A successful exploit of this vulnerability allows unauthorized access to sensitive database information, potential data tampering, and complete system compromise. With a CVSS score of 7.3, this flaw presents a significant risk to data confidentiality and availability, as attackers can exfiltrate proprietary information or disrupt core business booking operations.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators must restrict access to the /admin/add-boat.php endpoint to authorized internal network segments only or disable the affected functionality.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /admin/add-boat.php endpoint containing SQL syntax characters like single quotes, dashes, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the boatname parameter.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via the referenced GitHub security issue.

Analyst Notes: As of August 1, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it requires no authentication to trigger the malicious payload.

Analyst Recommendation

Given the availability of a public proof of concept and the lack of an official vendor patch, this vulnerability must be treated with high urgency. Administrators should immediately implement network-level access controls to block external reachability to the administration interface and monitor for any signs of unauthorized database interaction until a formal update is released.

Description Summary:
A critical SQL injection vulnerability in PHPGurukul Local Services Search Engine Management System 2.1 allows unauthenticated remote attackers to manipulate database queries via the editid parameter.

Executive Summary:
A critical SQL injection vulnerability exists in PHPGurukul Local Services Search Engine Management System 2.1 that allows unauthenticated attackers to execute unauthorized database operations.

Vulnerability Details

CVE-ID: CVE-2025-8179

Affected Software: PHPGurukul Local Services Search Engine Management System

Affected Versions: 2.1

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/changeimage.php file. The vulnerability occurs because the application fails to sanitize input provided to the editid parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database, potentially leading to sensitive data exfiltration, unauthorized data modification, or complete system compromise. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality, which could result in severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected use of UNION operators, SLEEP commands, or time-based blind injection signatures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the editid parameter in the /admin/changeimage.php file.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub security issue.

Analyst Notes: As of 2025-07-28, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of public exploit material and the lack of a vendor-supplied patch, this vulnerability poses a credible threat to any exposed instance of the affected software. Organizations currently running version 2.1 should prioritize isolating the application from public networks and implement strict input validation at the WAF level until an official security update is released by the vendor.

Description Summary:
PHPGurukul Land Record System 1.0 is vulnerable to SQL injection in the edit-property.php file via the editid parameter, allowing unauthenticated remote attackers to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Land Record System 1.0 allows unauthenticated attackers to compromise database integrity and access sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-7757

Affected Software: PHPGurukul Land Record System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the editid parameter within the /edit-property.php file, which is directly concatenated into SQL queries. This allows an unauthenticated, remote attacker to perform unauthorized database operations through injection attacks.

Business Impact

Successful exploitation of this vulnerability enables attackers to bypass authentication and gain unauthorized access to the backend database. This could lead to the exposure of sensitive land records, unauthorized data modification, or complete system compromise. Given the CVSS score of 7.3, this flaw presents a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /edit-property.php endpoint or disable the affected functionality entirely until a secure update is released.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as sleep commands or unexpected union operators, which are indicative of SQL injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection patterns targeting the editid parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of July 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it requires no authentication to trigger via a simple GET request.

Analyst Recommendation

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability renders the PHPGurukul Land Record System highly susceptible to automated exploitation. Organizations utilizing this software must prioritize the implementation of compensating controls, such as WAF filtering, to block malicious requests. Continuous monitoring for unauthorized database access is essential until the vendor provides a formal security update to remediate the underlying code flaw.

Description Summary:
PHPGurukul Hospital Management System 4.0 is vulnerable to remote SQL injection via the Username parameter in user-login.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Hospital Management System 4.0 allows remote attackers to compromise database integrity and potentially bypass authentication.

Vulnerability Details

CVE-ID: CVE-2025-7604

Affected Software: PHPGurukul Hospital Management System

Affected Versions: 4.0

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) affecting the Username argument within the /user-login.php file. The vulnerability is remotely exploitable without requiring any prior authentication by the attacker.

Business Impact

The ability to perform unauthorized SQL queries against the backend database poses a significant risk to data confidentiality and integrity. Given the 7.3 CVSS score, this flaw could lead to unauthorized access to patient records, administrative account takeovers, or complete database exposure, resulting in severe reputational damage and regulatory noncompliance.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the /user-login.php endpoint via network controls or a Web Application Firewall until the vendor releases a security update.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically focusing on characters commonly used in SQL injection attacks, such as single quotes, semicolons, and comment indicators within the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically designed to detect and block SQL injection signatures targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of July 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to its remote, unauthenticated nature.

Analyst Recommendation

The presence of a public proof-of-concept for this unauthenticated SQL injection flaw necessitates immediate attention. Organizations utilizing PHPGurukul Hospital Management System 4.0 must prioritize restricting network access to the affected login interface and actively monitor for suspicious traffic until a definitive vendor patch is applied.

Description Summary:
A SQL injection vulnerability in the admin user-profile.php file of PHPGurukul User Registration & Login and User Management System allows authenticated administrators to execute arbitrary SQL queries.

Executive Summary:
An authenticated SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System version 3.3 poses a risk of total database compromise for affected installations.

Vulnerability Details

CVE-ID: CVE-2025-7542

Affected Software: PHPGurukul User Registration & Login and User Management System

Affected Versions: 3.3 and below

Vulnerability: The application is vulnerable to SQL injection via the uid GET parameter in the /admin/user-profile.php file, which fails to sanitize input before embedding it into database queries. This flaw requires the attacker to possess an active administrator session to trigger.

Business Impact

Successful exploitation of this SQL injection vulnerability allows an authenticated attacker to perform unauthorized database enumeration, data exfiltration, and potential account hijacking. While the CVSS score of 7.3 reflects a significant risk, the impact is localized to the database layer, which may contain sensitive user credentials and personal information. Compromise of this data could lead to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /admin directory using IP whitelisting or additional authentication layers.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests to user-profile.php containing SQL syntax characters, such as single quotes, double dashes, or UNION keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the uid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up on GitHub.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of prepared statements in the source code.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, administrators must treat this vulnerability with high urgency. Implement the recommended WAF rules and access controls immediately to prevent unauthorized database access. Monitor the vendor website closely for the release of an official security update and apply it as soon as it becomes available.

Description Summary:
PHPGurukul Student Result Management System 2.0 is vulnerable to unauthenticated SQL injection via the nid parameter in notice-details.php, allowing remote attackers to extract database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Student Result Management System 2.0 poses a critical risk of full database compromise and unauthorized data extraction.

Vulnerability Details

CVE-ID: CVE-2025-7534

Affected Software: PHPGurukul Student Result Management System

Affected Versions: 2.0

Vulnerability: The application fails to sanitize the nid GET parameter in the notice-details.php file before incorporating it into a database query. This allows an unauthenticated attacker to inject arbitrary SQL commands to manipulate backend operations.

Business Impact

A successful exploit allows an attacker to bypass authentication and extract sensitive information from the database, including student records and administrative credentials. Given the CVSS score of 7.3, the potential for total database takeover and subsequent reputational damage or regulatory non-compliance regarding student privacy is significant.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected script or implement input validation to ensure the nid parameter only accepts expected integer values.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed at notice-details.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and detect common exploitation payloads, such as UNION-based or time-based queries.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept and technical write-up exist via the referenced GitHub repository.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication and targets a common GET parameter.

Analyst Recommendation

The vulnerability represents a severe risk to data integrity and confidentiality. Organizations currently running version 2.0 of this software must treat this as a priority, implementing WAF protections and input validation immediately to mitigate the risk of automated database dumping until a formal vendor update is released.

Description Summary:
PHPGurukul Vehicle Parking Management System 1.13 contains a SQL injection vulnerability in the admin login interface that allows remote, unauthenticated attackers to execute unauthorized database queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System 1.13 exposes the application to remote, unauthenticated data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-7521

Affected Software: PHPGurukul Vehicle Parking Management System

Affected Versions: 1.13

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) occurring within the Username argument of the /admin/index.php file. The vulnerability is remotely exploitable by an unauthenticated attacker without requiring user interaction.

Business Impact

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to the confidentiality, integrity, and availability of the application database. With a CVSS score of 7.3, this high severity flaw could lead to unauthorized data exfiltration, administrative credential compromise, or complete system takeover. Organizations relying on this system for parking management may suffer operational disruption and loss of sensitive user data if the database is successfully manipulated.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the admin interface via IP whitelisting or VPN tunnels until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests to /admin/index.php, specifically identifying patterns associated with SQL injection payloads, such as unexpected characters or database syntax in the Username parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to detect and block SQL injection patterns targeting the login fields of the administrative dashboard.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it resides in the authentication entry point and does not require pre-existing session privileges.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation for unauthenticated actors, this vulnerability represents an urgent security risk. Administrators must immediately implement network-level access controls to isolate the administrative interface from the public internet. Continue to monitor the vendor website for security updates and apply the necessary patches as soon as they are made available to permanently resolve the underlying code defect.

Description Summary:
PHPGurukul Online Fire Reporting System version 1.2 contains a critical SQL injection vulnerability in the requestid parameter, allowing unauthenticated attackers to manipulate the backend database.

Executive Summary:
A critical SQL injection vulnerability in the PHPGurukul Online Fire Reporting System allows unauthenticated attackers to achieve full database compromise.

Vulnerability Details

CVE-ID: CVE-2025-40692

Affected Software: PHPGurukul Online Fire Reporting System

Affected Versions: 1.2

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the requestid parameter of the /ofrs/details.php endpoint. The flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the database.

Business Impact

The ability to perform unauthorized database operations poses a severe threat to data integrity, confidentiality, and availability. Successful exploitation allows an attacker to retrieve, modify, or delete sensitive system records, which could lead to a complete compromise of the application data. Given the CVSS score of 9.8, this vulnerability represents a critical risk to business operations.

Remediation Plan

Immediate Action: Contact the vendor, PHPGurukul, to obtain the latest security update or patch for the Online Fire Reporting System. If a patch is not yet available, restrict access to the /ofrs/details.php endpoint.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual patterns targeting the requestid parameter. Monitor database query logs for unexpected delete or update operations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application. Ensure the database user account utilized by the web application adheres to the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no exploit is currently confirmed, the nature of the flaw makes it highly susceptible to automated scanning and exploitation.

Analyst Recommendation

Due to the critical nature of this SQL injection vulnerability and the lack of authentication required to trigger the flaw, immediate action is required. Organizations using the PHPGurukul Online Fire Reporting System should prioritize applying vendor-supplied patches or implementing restrictive network controls to prevent unauthorized access to the vulnerable endpoint. Failure to secure this entry point exposes the entire backend database to potential exfiltration or destruction.

Description Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Online Fire Reporting System v1.2 allows attackers to manipulate the database via the todate parameter.

Executive Summary:
A critical, unauthenticated SQL injection vulnerability in PHPGurukul Online Fire Reporting System v1.2 poses a severe risk of unauthorized database manipulation and total data compromise.

Vulnerability Details

CVE-ID: CVE-2025-40691

Affected Software: PHPGurukul Online Fire Reporting System

Affected Versions: 1.2

Vulnerability: This is an SQL injection flaw (CWE-89) occurring in the todate parameter at the /ofrs/admin/bwdates-report-result.php endpoint. The vulnerability is exploitable by unauthenticated remote attackers, allowing them to perform unauthorized CRUD operations against the underlying database.

Business Impact

The ability for an unauthenticated attacker to retrieve, create, update, or delete database records represents a catastrophic security failure. With a CVSS score of 9.8, the potential for unauthorized data exfiltration or total system integrity loss is extremely high, which could lead to significant regulatory non-compliance, loss of sensitive reporting data, and severe reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, administrators should restrict network access to the /ofrs/admin/ directory to trusted IP addresses only.

Proactive Monitoring: Monitor database query logs for anomalous activity, specifically looking for SQL syntax patterns or unexpected access to the bwdates-report-result.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the todate parameter.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to its unauthenticated nature and the direct access it provides to database operations.

Analyst Recommendation

Given the critical CVSS severity and the nature of SQL injection flaws, this vulnerability requires immediate attention. Security teams must prioritize restricting access to the affected endpoint while awaiting a vendor-supplied security update to remediate the underlying code vulnerability.

Description Summary:
A critical SQL injection vulnerability in PHPGurukul Online Fire Reporting System v1.2 allows unauthenticated attackers to manipulate the backend database via the teamid parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Online Fire Reporting System poses a critical risk of full database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-40690

Affected Software: PHPGurukul Online Fire Reporting System

Affected Versions: 1.2

Vulnerability: This flaw is a classic SQL injection (CWE-89) located in the /ofrs/admin/edit-team.php endpoint. An unauthenticated attacker can supply malicious input via the teamid parameter to execute arbitrary database commands.

Business Impact

The ability to retrieve, create, update, and delete database records represents a total loss of confidentiality, integrity, and availability for the affected system. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it provides a path for an attacker to gain complete control over the application data without requiring any prior authentication.

Remediation Plan

Immediate Action: Contact the vendor or review the official project repository for the latest security release, as a specific patch version is not currently listed in the provided data.

Proactive Monitoring: Inspect web server and database logs for anomalous query patterns, particularly those involving the teamid parameter or unexpected SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the /ofrs/admin/edit-team.php endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 11, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation has not been confirmed, the lack of authentication requirements makes this vulnerability highly attractive to attackers.

Analyst Recommendation

Due to the critical severity and the ease of exploitation, immediate action is required to secure the Online Fire Reporting System. Administrators should prioritize identifying and applying vendor-supplied patches or, if unavailable, implementing stringent input validation controls to neutralize the SQL injection vector.

Description Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Online Fire Reporting System v1.2 allows remote attackers to manipulate the database via the remark, status, and requestid parameters.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Online Fire Reporting System allows unauthenticated attackers to gain full control over the application database.

Vulnerability Details

CVE-ID: CVE-2025-40689

Affected Software: PHPGurukul Online Fire Reporting System

Affected Versions: 1.2

Vulnerability: This is an improper neutralization of special elements used in an SQL command (CWE-89) located in the /ofrs/admin/request-details.php endpoint. The vulnerability is exploitable by an unauthenticated attacker, allowing for unauthorized data retrieval, modification, or deletion.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for complete compromise of the application data without requiring authentication. Successful exploitation could lead to unauthorized access to sensitive fire reporting records, potential data loss, and complete loss of integrity for the affected system, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should contact the vendor for an update or apply input validation filters to the remark, status, and requestid parameters.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests to the /ofrs/admin/request-details.php endpoint that contain SQL syntax characters such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns targeting the specified vulnerable parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the direct impact on database operations.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation, immediate action is required to secure the vulnerable endpoint. If an official update is unavailable, prioritize the implementation of strict input validation and WAF rules to prevent malicious database queries until a vendor-supplied patch can be applied.

Description Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Online Fire Reporting System v1.2 allows remote attackers to manipulate the database via specific parameters in the add-team.php endpoint.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Online Fire Reporting System allows unauthenticated attackers to gain full control over the application database.

Vulnerability Details

CVE-ID: CVE-2025-40687

Affected Software: PHPGurukul Online Fire Reporting System

Affected Versions: 1.2

Vulnerability: This is a classic SQL injection flaw (CWE-89) triggered via the mobilenumber, teamleadname, and teammember parameters within the /ofrs/admin/add-team.php endpoint. The vulnerability is exploitable by an unauthenticated attacker, allowing for unauthorized retrieval, modification, or deletion of database contents.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands poses a catastrophic risk to data confidentiality, integrity, and availability. Given the CVSS score of 9.8, this vulnerability allows for complete compromise of the application backend, potentially leading to total data loss, unauthorized access to administrative functions, or the exfiltration of sensitive information stored within the system.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should restrict network access to the /ofrs/admin/ directory immediately and contact the vendor for an official security update.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests to the /ofrs/admin/add-team.php endpoint, specifically looking for SQL syntax patterns or unexpected character strings in the aforementioned parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules configured to inspect and block malicious inputs directed at the identified vulnerable parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements and the ability to perform destructive database operations make this flaw highly attractive to attackers, necessitating prompt defensive measures.

Analyst Recommendation

This vulnerability represents a critical security failure that requires immediate attention. Because the flaw is reachable without authentication, the risk of automated exploitation is high. Organizations utilizing this software must implement strict access controls and prioritize applying any forthcoming vendor patches as soon as they become available to prevent potential data compromise.

Description Summary:
PHPGurukul Tourism Management System 1.0 contains a SQL injection vulnerability in the admin/user-bookings.php file via the uid parameter, allowing remote unauthenticated attackers to execute queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Tourism Management System 1.0 permits remote unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13247

Affected Software: PHPGurukul Tourism Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection (CWE-89) triggered by improper sanitization of the uid parameter within the /admin/user-bookings.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The ability to perform unauthorized SQL queries against the application database poses a significant risk to data confidentiality and integrity. Given the 7.3 CVSS score, this vulnerability could lead to the exposure of sensitive user booking information or administrative credentials, potentially resulting in unauthorized system access and severe reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements until the vendor releases a security update.

Proactive Monitoring: Review application and web server access logs for anomalous patterns, such as SQL syntax characters or unexpected query parameters directed at the user-bookings.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation via simple URL parameter manipulation.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, organizations must treat this vulnerability with high priority. We strongly recommend implementing immediate network-level access controls to isolate the affected administrative components from the public internet. Continue to monitor the vendor website for official security updates and apply them immediately upon release.

Description Summary:
A SQL injection vulnerability exists in the Beauty Parlour Management System's search-invoices.php file, allowing unauthenticated remote attackers to manipulate searchdata arguments.

Executive Summary:
A high-severity SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 permits unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-11507

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is vulnerable to SQL injection via the searchdata argument in the /admin/search-invoices.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive application data stored within the database. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the system, potentially leading to total database compromise or unauthorized administrative actions.

Remediation Plan

Immediate Action: As no official patch is currently identified for this specific version, restrict access to the /admin/ directory using IP allowlisting or VPN requirements. Contact the vendor immediately regarding the availability of security updates for this SQL injection flaw.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the /admin/search-invoices.php endpoint, specifically looking for SQL syntax patterns within the searchdata parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting query parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub issue linked by the CVE record.

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Due to the unauthenticated nature of this SQL injection vulnerability and the availability of a public proof-of-concept, the risk of exploitation is elevated. Administrators should prioritize isolating the affected administrative interface from the public internet until a vendor-supplied patch is applied to the vulnerable search-invoices.php script.

Description Summary:
A SQL injection vulnerability in the search-appointment.php file of PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 poses a significant risk of unauthorized data access and potential database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-11506

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is vulnerable to SQL injection via the searchdata argument in the /admin/search-appointment.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure or modification of sensitive customer and appointment data stored within the application database. Given the CVSS score of 7.3, this represents a High severity risk that could result in significant reputational damage and a breach of data privacy compliance requirements.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/search-appointment.php endpoint via network controls or authentication layers.

Proactive Monitoring: Review web server access logs for anomalous request patterns targeting the searchdata parameter or signs of SQL syntax being passed in URL arguments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this specific application path.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record (https://github.com/f000x0/cve/issues/11).

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication and can be triggered remotely.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high CVSS score, this vulnerability should be prioritized for mitigation. Administrators must implement strict input validation or network-level access controls immediately until an official vendor update is released to address the underlying code flaw.

Description Summary:
A SQL injection vulnerability exists in the PHPGurukul Beauty Parlour Management System, allowing remote attackers to manipulate the delid parameter in /admin/new-appointment.php.

Executive Summary:
A remote SQL injection vulnerability in the PHPGurukul Beauty Parlour Management System permits unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11505

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the admin/new-appointment.php file. The application fails to properly sanitize the delid argument, allowing an unauthenticated remote attacker to execute malicious SQL queries.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized data access or manipulation. Successful exploitation can lead to the exposure of sensitive customer information or the compromise of the administrative backend, potentially resulting in significant reputational damage and loss of service availability.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected /admin/ directory using network-level controls or IP allowlisting.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the delid parameter or unusual patterns in SQL error logs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting URL parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/f000x0/cve/issues/10.

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk to affected installations. Organizations should prioritize isolating the vulnerable application from public networks until an official vendor update is released and applied.

Description Summary:
PHPGurukul Beauty Parlour Management System 1.1 is vulnerable to remote SQL injection via the delid argument in the /admin/manage-services.php file, allowing unauthenticated attackers to manipulate data.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 exposes the backend database to unauthenticated remote exploitation.

Vulnerability Details

CVE-ID: CVE-2025-11503

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The software fails to properly sanitize the delid parameter within the /admin/manage-services.php script, which results in a SQL injection vulnerability. This flaw can be triggered by an unauthenticated remote attacker.

Business Impact

Successful exploitation allows an attacker to interact directly with the application database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity and confidentiality of the system, which could result in service disruption or the exposure of sensitive customer information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/manage-services.php endpoint or disable the affected module until a fix is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the delid parameter in the manage-services.php file, specifically looking for SQL syntax patterns or unexpected character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain malicious SQL payloads directed at the vulnerable URI.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research findings documented in the GitHub issue referenced by the CVE record.

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running this software must implement strict network access controls to protect the administrative interface while awaiting an official security update from PHPGurukul.

Description Summary:
PHPGurukul Beauty Parlour Management System 1.1 is vulnerable to remote SQL injection via the delid argument in the /admin/invoices.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-11416

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application fails to properly sanitize the delid parameter within the /admin/invoices.php endpoint, which facilitates SQL injection. The vulnerability is exploitable remotely by an unauthenticated attacker.

Business Impact

Successful exploitation of this flaw allows attackers to interact with the underlying database, potentially leading to unauthorized data exposure, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of system data, which could result in severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory using IP whitelisting or VPN-only access to prevent unauthorized reachability.

Proactive Monitoring: Review web server access logs for suspicious patterns in GET or POST requests targeting /admin/invoices.php, particularly those containing SQL syntax characters like single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rulesets designed to detect and block SQL injection payloads targeting the delid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical reference provided by the vulnerability researcher (https://github.com/f000x0/cve/issues/4).

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

This vulnerability presents a high risk due to its unauthenticated remote attack vector and the availability of public proof-of-concept code. Given the absence of a vendor-supplied patch, organizations must prioritize the implementation of robust compensating controls, such as strict network access controls and WAF filtering, to protect the affected management system from potential compromise.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate the delid argument in /admin/customer-list.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 poses a significant risk of unauthorized database manipulation and information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-11415

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This is a SQL injection flaw (CWE-89) located in the /admin/customer-list.php file. An unauthenticated remote attacker can inject malicious SQL commands via the delid parameter to interact directly with the application database.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting its high potential for impact despite the limited scope of the affected component. Successful exploitation allows for unauthorized database queries, which may lead to the exfiltration of sensitive customer data, loss of data integrity, or complete compromise of the backend database management system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and evaluate the necessity of the Beauty Parlour Management System in the production environment.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting /admin/customer-list.php, specifically monitoring for unusual characters or SQL syntax patterns in the delid parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing common SQL injection payloads directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the publicly available proof-of-concept, exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization on the identified parameter.

Analyst Recommendation

Given the availability of a public exploit and the ease of remote execution, this vulnerability represents an urgent security risk. Organizations currently running PHPGurukul Beauty Parlour Management System 1.1 must prioritize isolating the application from external networks and implementing strict WAF filtering until an official vendor patch is released and verified.

Description Summary:
PHPGurukul Small CRM 4.0 is vulnerable to remote SQL injection via the email parameter in the forgot-password.php file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Small CRM 4.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11053

Affected Software: PHPGurukul Small CRM

Affected Versions: 4.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located within the forgot-password.php script. Unauthenticated attackers can inject malicious SQL commands via the email argument to interact with the backend database.

Business Impact

The ability to perform unauthorized SQL injection attacks poses a severe risk to the confidentiality and integrity of the organization. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exfiltration, database manipulation, or potential service disruption. Successful exploitation allows an attacker to bypass authentication mechanisms and gain unauthorized access to sensitive user information stored within the CRM database.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict access to the forgot-password.php endpoint or disable the affected functionality until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the forgot-password.php file, specifically looking for characters indicative of SQL injection such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the application's input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub repository.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its remote, unauthenticated nature and the lack of complex requirements for execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Security teams should prioritize limiting exposure of the Small CRM instance to the public internet and implementing stringent input validation at the WAF level until the vendor provides a formal patch. Failure to mitigate this flaw increases the likelihood of unauthorized database access and data compromise.

Description Summary:
PHPGurukul Small CRM 4.0 contains a SQL injection vulnerability in the create-ticket.php file, allowing remote attackers to manipulate the subject argument to execute arbitrary SQL commands.

Executive Summary:
A remote SQL injection vulnerability in PHPGurukul Small CRM 4.0 exposes the application to unauthorized database manipulation by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-10664

Affected Software: PHPGurukul Small CRM

Affected Versions: 4.0

Vulnerability: This is a SQL injection (CWE-89) vulnerability located within the create-ticket.php file. The application fails to properly sanitize the subject argument, allowing an unauthenticated remote attacker to inject malicious SQL queries.

Business Impact

The ability to perform SQL injection poses a significant risk to the confidentiality and integrity of the CRM database. An attacker could potentially extract sensitive customer information, modify records, or disrupt service availability. With a CVSS score of 7.3, this flaw is considered High severity, as it allows unauthenticated access to backend data stores.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the /create-ticket.php endpoint via network controls or authentication barriers until the vendor releases a secure version.

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected union statements, or suspicious character patterns indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the subject parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of September 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input validation on a publicly accessible endpoint.

Analyst Recommendation

Given the High severity and the availability of a public proof-of-concept, this vulnerability presents an immediate risk to environments utilizing PHPGurukul Small CRM 4.0. Administrators must prioritize isolating the affected component or applying custom input validation filters to prevent unauthorized database access. Monitor vendor channels closely for the release of an official security patch.

Description Summary:
PHPGurukul Online Course Registration 3.1 is vulnerable to remote SQL injection via the cgpa argument in the my-profile.php file.

Executive Summary:
A remote SQL injection vulnerability in PHPGurukul Online Course Registration 3.1 allows unauthenticated attackers to manipulate database queries, posing a high risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-10663

Affected Software: PHPGurukul Online Course Registration

Affected Versions: 3.1

Vulnerability: This vulnerability is a SQL Injection (CWE-89) flaw located within the my-profile.php script. An unauthenticated attacker can supply malicious input to the cgpa parameter to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this flaw allows attackers to interact directly with the application database, potentially leading to unauthorized data exposure, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of user information stored within the registration system.

Remediation Plan

Immediate Action: Since an official patch is currently unknown, administrators should restrict access to the my-profile.php file or disable the application until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax, such as UNION, SELECT, or OR statements, directed at the my-profile.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the cgpa parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the GitHub issue linked in the vulnerability record.

Analyst Notes: As of September 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly increases the risk of exploitation by opportunistic attackers. Organizations using PHPGurukul Online Course Registration 3.1 must prioritize applying vendor-supplied updates as soon as they become available and should enforce strict input validation or network-level access controls immediately to mitigate the threat.

Description Summary:
PHPGurukul User Management System 1.0 is vulnerable to unauthenticated SQL injection via the emailid parameter in login.php, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul User Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10624

Affected Software: PHPGurukul User Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the emailid parameter within the login.php file. This flaw permits unauthenticated attackers to perform SQL injection attacks, potentially leading to unauthorized database manipulation.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive application data or the corruption of database records. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in unauthorized administrative access or full system compromise depending on database permissions.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the login.php endpoint using network-level controls or by disabling the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor web server access logs for anomalous SQL syntax patterns or unexpected query structures targeting the login.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts directed at the emailid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/CSentinel/CVE/issues/3.

Analyst Notes: As of September 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication and can be initiated remotely.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running PHPGurukul User Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate this risk until the vendor provides a formal security update.

Description Summary:
PHPGurukul Online Discussion Forum 1.0 contains a SQL injection vulnerability in the admin/edit_member.php file, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A remote SQL injection vulnerability in PHPGurukul Online Discussion Forum 1.0 allows unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10604

Affected Software: PHPGurukul Online Discussion Forum

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw located in the admin/edit_member.php file. The vulnerability is exploitable by an unauthenticated remote attacker through the manipulation of the ID parameter.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the application database, potential data exfiltration, or modification of administrative records. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the confidentiality and integrity of the forum environment, leading to significant operational disruption.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or additional authentication layers.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the /admin/edit_member.php endpoint, specifically looking for SQL syntax patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts, which can provide a virtual patch until the vendor releases a formal security update.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability findings.

Analyst Notes: As of September 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation over the network without requiring any prior authentication.

Analyst Recommendation

This vulnerability presents a clear and present risk due to the publicly available proof-of-concept code. IT teams must prioritize securing the affected administrative interface immediately. Because a formal vendor patch is missing, implementing strict network-level access controls and WAF filtering is essential to prevent unauthorized database access.

Description Summary:
PHPGurukul Online Discussion Forum 1.0 contains a SQL injection vulnerability in the search functionality of the admin panel, allowing remote unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Online Discussion Forum 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially extract sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-10603

Affected Software: PHPGurukul Online Discussion Forum

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) via the Search argument in the /admin/admin_forum/search_result.php file, which fails to properly sanitize user input before processing database queries. An unauthenticated remote attacker can trigger this flaw by manipulating the input parameter.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to the application database, potential data exfiltration, and the loss of confidentiality or integrity regarding forum content and user information. With a CVSS score of 7.3, this represents a high-risk security flaw that requires immediate attention to prevent unauthorized administrative or data-level access.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin directory using IP whitelisting or VPN-only access to prevent reachability by unauthorized parties.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/admin_forum/search_result.php, specifically looking for input strings containing SQL syntax characters like single quotes or semicolon delimiters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically configured to block and alert on SQL injection patterns targeting the identified search parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher write-up at the referenced GitHub repository.

Analyst Notes: As of September 18, 2025, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute malicious queries.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to the integrity of the affected platform. Administrators must prioritize restricting external access to the vulnerable administration endpoints immediately and should seek to migrate away from this software if security updates are not provided by the vendor.

Description Summary:
A SQL injection vulnerability in the Beauty Parlour Management System allows remote unauthenticated attackers to manipulate the delid argument in the all-appointment.php file.

Executive Summary:
The PHPGurukul Beauty Parlour Management System is vulnerable to a remote SQL injection attack, which could allow an unauthenticated attacker to compromise system data.

Vulnerability Details

CVE-ID: CVE-2025-10459

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is susceptible to SQL injection via the delid parameter in the /admin/all-appointment.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow unauthorized actors to interact with the underlying database, potentially leading to data exfiltration or corruption. Given the CVSS score of 7.3, this flaw is categorized as High severity, posing a significant risk to the confidentiality and integrity of the management system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/all-appointment.php file or the entire application until the vendor provides a security update.

Proactive Monitoring: Review web server access logs for suspicious patterns involving the delid parameter, especially requests containing SQL syntax or unusual characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability reporter at the referenced GitHub repository.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its accessibility without authentication.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of this SQL injection vulnerability. Organizations utilizing this system must prioritize restricting external access to the affected components and monitor for signs of unauthorized database queries until a formal vendor patch is released and applied.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate the viewid argument in view-enquiry.php.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 exposes the application to remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10403

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This vulnerability is a SQL injection (CWE-89) triggered via the viewid parameter in the /admin/view-enquiry.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive parlor data, including customer inquiries and administrative information. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential data breaches or unauthorized system control.

Remediation Plan

Immediate Action: Since no official patch is currently available from the vendor, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed at the view-enquiry.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads targeting the viewid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the GitHub issue tracker.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a credible risk to all installations of PHPGurukul Beauty Parlour Management System 1.1. Organizations must implement strict network-level access controls to the administrative interface immediately to mitigate the risk of unauthorized database access until the vendor releases a secure version.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate the delid argument in /admin/readenq.php.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-10402

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is susceptible to SQL injection via the delid parameter in the /admin/readenq.php file. This vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to sensitive administrative data or complete database compromise. With a CVSS score of 7.3, this flaw represents a significant security risk, especially given the ease of remote execution.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication until a vendor fix is released.

Proactive Monitoring: Security teams should audit web server access logs for suspicious input patterns, specifically looking for SQL syntax or unusual characters within the delid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given that this vulnerability is remotely exploitable without authentication and a public proof-of-concept is available, organizations should prioritize isolating the affected system. It is imperative to monitor for signs of unauthorized database interaction and implement strict access controls until the vendor provides an official security patch.

Description Summary:
PHPGurukul Small CRM 4.0 is susceptible to remote SQL injection via the Contact argument in the get-quote.php file, potentially allowing unauthorized database interaction.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Small CRM 4.0 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-10079

Affected Software: PHPGurukul Small CRM

Affected Versions: 4.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the get-quote.php script. It allows an unauthenticated remote attacker to manipulate the Contact parameter to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject SQL commands presents a significant risk to data privacy and system integrity. Successful exploitation could lead to unauthorized data exfiltration, database modification, or complete service disruption. Given the CVSS score of 7.3, this issue is classified as high severity, reflecting the ease of remote exploitation without prior authentication.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the get-quote.php file or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for anomalous HTTP requests containing SQL syntax or unusual input patterns directed at the get-quote.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block malicious SQL injection payloads targeting the Contact parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of remote execution, this vulnerability poses a credible risk to any organization running PHPGurukul Small CRM 4.0. Organizations must prioritize restricting access to the vulnerable endpoint and monitor for signs of unauthorized database interaction until a formal patch is provided by the vendor.