Which versions of Student Record System are affected by CVE-2025-6913?

Organizations using A vulnerability classified as critical should be aware of moderate risk from CVE-2025-6913, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-6913?

Yes, a public proof-of-concept exploit is available for CVE-2025-6913. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6913?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Student Record System CVE-2025-6913

Q: What is the CVSS score of CVE-2025-6913?

CVE-2025-6913 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-19551 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-30 cna@vuldb.com

PHP SQLi Student Record System Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Low privileges (PR:L), no user interaction, limited to confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-19551

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

PoC Detected

Jul 08, 2025 - 14:14 vuln.today

Public exploit code

CVE Published

Jun 30, 2025 - 16:15 cve.org

LOW 2.1

CVE Published

Jun 30, 2025 - 16:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Remote SQL injection in PHPGurukul Student Record System 3.2 allows authenticated attackers to manipulate the aemailid parameter via /admin-profile.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation (CISA KEV) or vendor patch has been confirmed at this time.

Technical ContextAI

The vulnerability resides in the PHP-based web application handling user input in the aemailid argument of /admin-profile.php. The root cause is improper neutralization of special elements (CWE-74) used in a database query, resulting in SQL injection. The affected product is identified by CPE cpe:2.3:a:phpgurukul:student_record_system:3.2:*:*:*:*:*:*:*.

RemediationAI

No vendor patch is available at time of analysis. Mitigations include implementing strict input validation/sanitization on the aemailid parameter, deploying a Web Application Firewall rule to detect SQL injection patterns, and restricting network access to the /admin-profile.php endpoint to trusted hosts. If the admin profile functionality is not critical, consider temporarily disabling the file. Note that all mitigations are compensating controls and may not eliminate the root cause.