Which versions of PHP are affected by EUVD-2025-18729?

A SQL injection vulnerability in PHPGurukul Pre-School Enrollment System 1.0 allows unauthenticated remote attackers to compromise the database, potentially exposing sensitive student and enrollment…

Is there a public PoC exploit available for EUVD-2025-18729?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18729. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18729?

Within 24 hours: Disable or restrict access to /admin/check_availability.php if the system is internet-facing; review access logs for suspicious activity. Within 7 days: Deploy WAF rules to block SQL injection patterns targeting the Username parameter; validate if your organization uses this specific software version. Within 30 days: Plan migration to a patched version or alternative enrollment system; if no patch becomes available, conduct thorough database audit for unauthorized access.

PHP EUVD-2025-18729

Q: What is the CVSS score of EUVD-2025-18729?

EUVD-2025-18729 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6318 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Pre School Enrollment System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18729

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 21:09 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in PHPGurukul Pre-School Enrollment System 1.0. This vulnerability affects unknown code of the file /admin/check_availability.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6318 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /admin/check_availability.php file where the 'Username' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure of exploitation details and confirmed POC availability indicate active exploitation risk in the wild.

Technical ContextAI

This vulnerability exists in PHP-based web application code within the administrative interface of a pre-school enrollment management system. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which manifests as SQL injection—a failure to properly validate and parameterize user input before incorporating it into SQL database queries. The vulnerable endpoint /admin/check_availability.php processes the 'Username' parameter without adequate input filtering or prepared statements, allowing attackers to inject arbitrary SQL commands. The affected product is PHPGurukul Pre-School Enrollment System CPE: cpe:2.3:a:phpgurukul:pre-school_enrollment_system:1.0:*:*:*:*:*:*:*

RemediationAI

Immediate Mitigation: Restrict administrative access to /admin/check_availability.php via firewall or WAF rules limiting access to trusted IP addresses only, pending patch availability Code-Level Fix: Implement parameterized queries (prepared statements) for the Username parameter in /admin/check_availability.php to neutralize SQL injection. Replace direct string concatenation with parameterized query syntax appropriate to the database driver (e.g., PDO with ? placeholders, mysqli with parameterized statements) Input Validation: Enforce strict input validation on the Username parameter: whitelist alphanumeric characters and underscores, implement length limits, reject special characters including SQL metacharacters (', ", ;, --, /*), and apply server-side validation Database Hardening: Configure database user accounts with principle of least privilege—ensure the application's database user lacks DROP, ALTER, or elevated privileges; restrict to SELECT/INSERT/UPDATE on necessary tables only Patch / Upgrade: Await and apply security patches from PHPGurukul as they become available. Monitor the vendor's advisory channels for patched version releases. Consider migrating to maintained alternatives if PHPGurukul ceases active support Detection: Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Username parameter (e.g., rules detecting UNION, SELECT, OR 1=1, --, /* */, etc.)