Which versions of PHPGurukul Local Services are affected by CVE-2025-6863?

Organizations using A vulnerability classified as critical face moderate risk from CVE-2025-6863, a injection vulnerability rated CVSS 7.3.

Is there a public PoC exploit available for CVE-2025-6863?

Yes, a public proof-of-concept exploit is available for CVE-2025-6863. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6863?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHPGurukul Local Services CVE-2025-6863

Q: What is the CVSS score of CVE-2025-6863?

CVE-2025-6863 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19486 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-29 cna@vuldb.com

PHP SQLi Local Services Search Engine Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible SQL injection in /admin/ endpoint with low data confidentiality, integrity, and availability impact; PR:N assumed per provided CVSS 4.0 vector despite atypical admin-panel unauthenticated access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 01:15 euvd

EUVD-2025-19486

Analysis Generated

Mar 16, 2026 - 01:15 vuln.today

PoC Detected

Jul 01, 2025 - 12:58 vuln.today

Public exploit code

CVE Published

Jun 29, 2025 - 15:15 cve.org

MEDIUM 5.5

CVE Published

Jun 29, 2025 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/edit-category-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in PHPGurukul Local Services Search Engine Management System 2.1 enables remote unauthenticated attackers to inject arbitrary SQL commands via the editid parameter in /admin/edit-category-detail.php, potentially allowing unauthorized database access or modification. A publicly available proof-of-concept exists, but real-world exploitation remains minimal with EPSS at 0.06% (18th percentile), indicating the vulnerable application has extremely limited deployment footprint despite the publicly disclosed vulnerability.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: improper neutralization of special elements in output) in a PHP-based local services directory application. The /admin/edit-category-detail.php endpoint fails to sanitize or parameterize the editid parameter before incorporating it into database queries, allowing attackers to construct malicious SQL statements. The application likely concatenates user input directly into SQL query strings without using prepared statements or parameterized query mechanisms, a decades-old anti-pattern in PHP development.

RemediationAI

No vendor-released patch has been identified as of analysis time. Immediate workarounds: disable remote access to /admin/ endpoints via firewall or WAF rules, implement network-based SQL injection detection and blocking, enforce strict input validation requiring numeric-only values for editid parameter, and implement parameterized queries or prepared statements in the application code if accessible for patching. If the application is deployed, isolate it on a network segment with restricted access, monitor database activity for suspicious queries, and consider replacing the application with a maintained alternative given the lack of active vendor support.