What is the CVSS score of CVE-2025-50489?

CVE-2025-50489 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of PHP are affected by CVE-2025-50489?

PHPGurukul Student Result Management System v2.0 fails to invalidate user sessions when passwords are changed, allowing attackers holding previously stolen credentials to retain authenticated access…

Is there a public PoC exploit available for CVE-2025-50489?

Yes, a public proof-of-concept exploit is available for CVE-2025-50489. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-50489?

Within 24 hours: Enumerate all PHPGurukul v2.0 instances in your organization; review authentication logs and session databases for anomalous activity patterns; communicate risk to institutional leadership. Within 7 days: Deploy compensating controls by implementing forced session termination upon password change (via WAF, reverse proxy rules, or application modification); enforce maximum session idle timeout of 30 minutes or less; force re-authentication of all active users. Within 30 days: Escalate to PHPGurukul vendor for security patch timeline; establish migration plan to patched version; conduct institution-wide incident assessment with affected departments.

PHP CVE-2025-50489

HIGH

Improper Input Validation (CWE-20)

2025-07-28 cve@mitre.org

Information Disclosure PHP Student Result Management System

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:52 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component failing to invalidate existing sessions after a password change, so an attacker holding a previously captured session token retains authenticated access even after the victim rotates their credentials. Publicly available exploit code exists on GitHub, though the flaw is not listed in CISA KEV and carries a modest EPSS score of 0.62% (45th percentile), indicating low observed exploitation activity. The vulnerability primarily undermines the account-recovery security guarantee that changing a password should terminate compromised sessions.