PHP EUVD-2025-19538

We need to produce a JSON object with all the specified fields. The input data: CVE-2025-6912, PHPGurukul Student Record System 3.2, SQL injection in /manage-students.php via del parameter. CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P ... So attack vector network, low complexity, privileges required low (PR:L), user interaction none, vulnerable system impact low on confidentiality, integrity, availability. Exploit maturity is Proof-of-Concept (E:P). The CVSS score is 2.1? That's very low. But it says rated as critical in the description, but CVSS 2.1 is low. The description says rated as critical, but CVSS base score might be different; we'll use the provided CVSS vector to assess. EPSS 0.04% percentile 13% - low. No KEV listing. POC is publicly available (from description and tags). No patch data provided. We'll synthesize.

product_name: "Student Record System" (as specific product, from CPE: phpGurukul Student Record System, so "Student Record System" or "PHPGurukul Student Record System"? The instruction: 1-3 words ONLY. The specific product or service name affected. "Student Record System" is fine, maybe "PHPGurukul Student Record System" too many words? 3 words: "PHPGurukul Student Record System"? Actually "PHPGurukul Student Record System" is 4 words. I can simplify to "Student Record System" because the vendor is known, but we must be specific. The CPE says phpGurukul:student_record_system. So product name: "Student Record System". I'll go with "Student Record System". But to be clear: "PHPGurukul Student Record System" might be too long. I'll go "PHPGurukul Student Record System" (3 words if I count: PHPGurukul, Student, Record, System? Actually "PHPGurukul" is one word, "Student Record System" three, total 4. I could do "Student Record System" alone. The CVE description says "PHPGurukul Student Record System 3.2". That's the product. The vendor is PHPGurukul, product Student Record System. So I'll put "Student