Which versions of PHP are affected by CVE-2025-7474?

A critical SQL injection vulnerability in Job Diary 1.0 allows remote attackers to compromise database integrity and potentially access sensitive data without authentication.

Is there a public PoC exploit available for CVE-2025-7474?

Yes, a public proof-of-concept exploit is available for CVE-2025-7474. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7474?

Within 24 hours: Inventory all systems running Job Diary 1.0 and restrict network access to the /search.php endpoint using firewall rules or WAF policies. Within 7 days: Deploy a Web Application Firewall (WAF) with SQL injection detection rules and implement input validation on the Search parameter; consider disabling the search functionality if not critical. Within 30 days: Evaluate alternative solutions or plan migration away from Job Diary 1.0, as no vendor patch exists and the application appears abandoned.

PHP CVE-2025-7474

Q: What is the CVSS score of CVE-2025-7474?

CVE-2025-7474 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21217 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-12 cna@vuldb.com

PHP SQLi Job Diary Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21217

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 18:08 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 12:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Job Diary 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search.php. The manipulation of the argument Search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.

Technical ContextAI

The vulnerability stems from improper input validation and parameterization in the Search parameter of /search.php, classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'). The root cause involves unsanitized user input being directly concatenated into SQL queries without prepared statements or parameterized query mechanisms. Job Diary 1.0 is a PHP-based application (CPE: cpe:2.3:a:code-projects:job_diary:1.0:*:*:*:*:*:*:*) that typically runs on standard LAMP stacks. The /search.php endpoint accepts GET/POST parameters without adequate escaping, enabling classic SQL injection techniques such as UNION-based, time-based blind, or error-based injection methods.