Which versions of PHP are affected by CVE-2025-6885?

CVE-2025-6885 presents moderate security risk, a injection vulnerability rated CVSS 7.3.

Is there a public PoC exploit available for CVE-2025-6885?

Yes, a public proof-of-concept exploit is available for CVE-2025-6885. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6885?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2025-6885

Q: What is the CVSS score of CVE-2025-6885?

CVE-2025-6885 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-19509 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-30 cna@vuldb.com

PHP SQLi Teachers Record Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-19509

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

PoC Detected

Jul 08, 2025 - 14:17 vuln.today

Public exploit code

CVE Published

Jun 30, 2025 - 04:15 nvd

HIGH 7.3

CVE Published

Jun 30, 2025 - 04:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/edit-teacher-detail.php. The manipulation of the argument tid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

We need to analyze CVE-2025-6885: PHPGurukul Teachers Record Management System 2.1, SQL injection in /admin/edit-teacher-detail.php via tid. Critical classification, but CVSS? Provided CVSS vector is 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... This is a base score 5.5 (medium) from the vector. But the CVSS 3.1 vector is missing. Need to generate own assessed CVSS 3.1 vector. Given PR:N, UI:N, and attack vector network, but impact low integrity, low confidentiality, low availability? Wait, VC:L, VI:L, VA:L (vulnerable system impact low for all three). So this SQL injection is low impact? But SQL injection typically can be high. Perhaps the attack is limited. The CVSS 4.0 score is from the source (probably VulDB). We'll have to synthesize.

Multi-source: EPSS 0.05% (percentile 14%) - very low exploitation probability. No KEV (not in input). POC/Exploit: Publicly available (disclosed to the public). CWE-74? Actually description says sql injection (CWE-89 should be). But provided CWE is CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – generic injection. I'll use that. CPE: phpgurukul:teachers_record_management_system:2.1. Product name: "Teachers Record Management System". 1-3 words. So "Teachers Record Management System". Could be "PHPGurukul Teachers Record Management System" too long, but 1-3 words: "Teachers Record Management System" is fine.

Summary: Need original synthesis. Not copy description. Mention SQL injection, remote, POC available, EPSS low, no active exploitation. Mention product and version. "Remote SQL injection in PHPGurukul Teachers Record Management System 2.1 via tid parameter in /admin/edit-teacher-detail.php allows attackers to manipulate database queries, potentially leading to data exposure or modification."

Technical context: Underlying technology: PHP web application, SQL injection via parameter tid. Root cause: failure to sanitize in