What is the CVSS score of CVE-2025-70899?

CVE-2025-70899 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Online Course Registration are affected by CVE-2025-70899?

CVE-2025-70899 presents notable security risk, a cross-site request forgery vulnerability rated CVSS 6.5. Users could be tricked into performing unintended actions.

Is there a public PoC exploit available for CVE-2025-70899?

Yes, a public proof-of-concept exploit is available for CVE-2025-70899. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-70899?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Online Course Registration CVE-2025-70899

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-01-22 cve@mitre.org

CSRF Online Course Registration Phpgurukul

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 02, 2026 - 20:01 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 17:16 nvd

MEDIUM 6.5

DescriptionCVE.org

PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage.

AnalysisAI

Online Course Registration versions up to 3.1 is affected by cross-site request forgery (csrf) (CVSS 6.5).

Technical ContextAI

This vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affects Online Course Registration. PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage.