Which versions of PHP are affected by CVE-2025-7593?

A SQL injection vulnerability in Job Diary 1.0 allows unauthenticated remote attackers to exploit the /view-all.php endpoint and potentially access, modify, or delete sensitive database records.

Is there a public PoC exploit available for CVE-2025-7593?

Yes, a public proof-of-concept exploit is available for CVE-2025-7593. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7593?

Within 24 hours: Isolate affected Job Diary instances from production networks or disable public access to /view-all.php. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns on the ID parameter, and conduct database access logs review for signs of exploitation. Within 30 days: Evaluate migration to alternative solutions, contact vendor for patch status, or implement comprehensive input validation and parameterized queries if in-house patching is feasible.

PHP CVE-2025-7593

Q: What is the CVSS score of CVE-2025-7593?

CVE-2025-7593 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21335 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-14 cna@vuldb.com

PHP SQLi Job Diary Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21335

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Sep 29, 2025 - 21:14 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 10:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-all.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7593 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-all.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate sensitive data, modify records, or disrupt application availability. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high impact across confidentiality, integrity, and availability. This represents an active threat requiring immediate patching.

Technical ContextAI

The vulnerability exists in Job Diary 1.0, a PHP-based web application, specifically within the /view-all.php file where user-supplied input via the ID parameter is incorporated directly into SQL queries without proper sanitization or parameterized prepared statements. This represents CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses SQL injection patterns where untrusted input reaches database query construction. The root cause is the failure to use prepared statements or input validation mechanisms before constructing SQL commands, allowing attackers to inject malicious SQL syntax to alter query logic. The affected product is identified as code-projects Job Diary version 1.0, distributed as a web application likely running on Apache/PHP infrastructure.

RemediationAI

Immediate actions: (1) Implement input validation and parameterized prepared statements (prepared queries with bound parameters) for all database operations, especially the ID parameter in /view-all.php; (2) Apply principle of least privilege—database user accounts should have minimal required permissions; (3) Enable SQL error suppression to prevent information disclosure; (4) Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting /view-all.php; (5) Monitor database activity for suspicious queries. Vendor patch: Update to a patched version of Job Diary if available from code-projects (version pending publication). If no official patch exists, temporary mitigation includes disabling /view-all.php functionality or restricting access via IP whitelisting/authentication until a patch is released. Perform comprehensive SQL injection testing post-remediation.