Is there a public PoC exploit available for EUVD-2025-21247?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21247. Prioritise patching immediately. EPSS: 0.1%.

Vehicle Parking Management System EUVD-2025-21247

Q: What is the CVSS score of EUVD-2025-21247?

EUVD-2025-21247 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-7520 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Vehicle Parking Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Admin-panel SQLi requires authenticated low-privilege access via network; impact is bounded to the application database with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21247

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Sep 26, 2025 - 13:52 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 05:15 cve.org

LOW 2.1

CVE Published

Jul 13, 2025 - 05:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in PHPGurukul Vehicle Parking Management System 1.13. This issue affects some unknown processing of the file /admin/manage-category.php. The manipulation of the argument del leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 exposes the admin-facing /admin/manage-category.php endpoint to database manipulation via an unsanitized del parameter. Authenticated remote attackers can craft HTTP requests to read or modify the underlying database, with a publicly available proof-of-concept exploit already disclosed. No active exploitation has been confirmed in CISA KEV at time of analysis, and the EPSS score of 0.06% places exploitation probability in the 20th percentile.

Technical ContextAI

The affected product is a PHP-based web application for managing vehicle parking operations, identified by CPE cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13. The root cause is CWE-74 (Injection), the parent class encompassing CWE-89 SQL Injection - the del GET/POST argument passed to the category management controller is interpolated directly into SQL queries without sanitization or parameterization. Because the vulnerable endpoint resides under the /admin/ path, exploitation requires a session with at least low-level administrative credentials, consistent with the CVSS 4.0 PR:L metric. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N reflects a network-reachable, low-complexity injection with bounded and scope-contained impact.

RemediationAI

No vendor-released patch with an exact fix version has been identified in the available data. Operators should monitor phpgurukul.com and the VulDB advisory at https://vuldb.com/?id.316217 for an updated release. As an immediate compensating control, restrict access to the /admin/ directory to trusted IP addresses via web server ACLs or a WAF rule - this reduces the attack surface to the internal network and prevents remote exploitation entirely. Additionally, deploying a WAF rule to block SQL metacharacters (single quotes, UNION, SELECT keywords) in the del parameter will mitigate the specific injection vector with low side-effect risk. Input validation and parameterized queries in the source code are the only permanent remediation; applying prepared statements to the del parameter in manage-category.php eliminates the root cause. Do not expose admin panels to the public internet without authentication hardening.