Phpgurukul
Monthly
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate the awarddetails parameter in /admin/add-artist.php, potentially leading to data breach or system compromise. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage4.php. Public exploit code exists, increasing risk for instances with admin panel exposure.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage3.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage2.php. A public exploit is available, but no active exploitation has been reported (EPSS 0.08%).
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate database queries via the editid parameter in /admin/changeimage1.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage.php. A public exploit is available, but no active exploitation has been reported. The EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to manipulate the imageid parameter in /admin/changepropic.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the 'editid' parameter in /admin/edit-art-medium-detail.php. Public exploit code is available, increasing the risk of targeted attacks.
CVE-2025-6409 is a critical SQL injection vulnerability in PHPGurukul Art Gallery Management System 1.1 affecting the /admin/forgot-password.php endpoint. An unauthenticated remote attacker can manipulate the 'email' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with proof-of-concept availability, making it actively exploitable in the wild.
SQL injection in PHPGurukul Directory Management System 2.0 allows authenticated attackers to manipulate the adminname parameter in /admin/admin-profile.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been confirmed.
SQL injection in PHPGurukul Directory Management System 2.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-directory.php. A public exploit is available, increasing the risk of exploitation, though EPSS score is low (0.06%).
SQL injection in PHPGurukul Directory Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-directory.php. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
CVE-2025-6330 is a critical SQL injection vulnerability in PHPGurukul Directory Management System version 1.0, specifically in the /searchdata.php file's 'searchdata' parameter. An unauthenticated remote attacker can inject arbitrary SQL commands to compromise confidentiality, integrity, and availability of the underlying database. Public disclosure and proof-of-concept exploitation have occurred, making this an immediately actionable threat despite the moderate CVSS 7.3 score.
CVE-2025-6323 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, specifically affecting the /enrollment.php file's 'fathername' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the enrollment database. The vulnerability has public proof-of-concept code available and may be actively exploited in the wild.
CVE-2025-6322 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /visit.php file's 'gname' parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and confirmed POC availability significantly elevate real-world exploitation risk.
SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers with sub-admin privileges to execute arbitrary SQL commands via the sadminusername parameter in /admin/add-subadmin.php. Public exploit code is available, increasing risk for unpatched installations.
SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers to manipulate the classname parameter in /admin/add-class.php, potentially leading to data leakage or modification. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating low exploitation likelihood.
SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers to manipulate the tsubject parameter in /admin/add-teacher.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.
CVE-2025-6318 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /admin/check_availability.php file where the 'Username' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure of exploitation details and confirmed POC availability indicate active exploitation risk in the wild.
A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.
SQL injection in PHPGurukul Emergency Ambulance Hiring Portal 1.0 allows authenticated attackers to execute arbitrary SQL commands via the 'ambregnum' parameter in /admin/add-ambulance.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Emergency Ambulance Hiring Portal 1.0 allows authenticated attackers to manipulate database queries via the fromdate/todate parameters in /admin/bwdates-request-report-details.php. Public exploit code exists, but EPSS score is low (0.06%) and no active exploitation has been reported.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Open redirect vulnerability in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to redirect users to arbitrary external sites via the 'q' parameter in /search-report-result.php. The exploit has been publicly disclosed, increasing risk of phishing attacks. EPSS score is low (0.04%), indicating low exploitation likelihood in the wild.
Cross-site scripting (XSS) in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in /search-report-result.php. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site request forgery in PHPGurukul Car Rental Portal 3.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but exploitation requires user interaction and no active exploitation has been confirmed.
Critical SQL injection vulnerability in PHPGurukul Nipah Virus Testing Management System version 1.0, located in the /registered-user-testing.php file where the 'testtype' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk in production environments.
SQL injection in PHPGurukul Nipah Virus Testing Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the testtype parameter in /bwdates-report-ds.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating limited exploitation likelihood.
Critical SQL injection vulnerability in PHPGurukul Hostel Management System 1.0 affecting the login functionality (/includes/login-hm.inc.php). An unauthenticated attacker can manipulate the Username parameter to execute arbitrary SQL queries remotely, potentially compromising data confidentiality, integrity, and availability. Public exploit disclosure and active exploitation potential significantly elevate real-world risk despite a moderate CVSS score of 7.3.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
Stored cross-site scripting in PHPGurukul Nipah Virus Testing Management System 1.0 allows authenticated attackers to inject arbitrary web scripts via the 'serachdata' parameter in /search-report.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the Name parameter in /contact.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.05%), indicating low exploitation likelihood.
Stored cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the 'pagedes' parameter in /admin/aboutus.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Stored cross-site scripting in PHPGurukul Rail Pass Management System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the 'fullname' parameter in /admin/add-pass.php. The exploit has been publicly disclosed, increasing the risk of targeted attacks against administrative users.
Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the searchdata parameter in /rpms/download-pass.php. The vulnerability is publicly exploited with a disclosed proof-of-concept, though EPSS score is low (0.07%), indicating limited active exploitation.
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the searchdata parameter in /check-status.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated attackers with high privileges to inject arbitrary web script via the tableno parameter in the admin add-table page, enabling data manipulation or session theft when another administrator views the tainted content. No active exploitation has been confirmed, but a public proof-of-concept is available.
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the fullname parameter in /admin/manage-subadmins.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the 'fullname' parameter in /admin/add-subadmin.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating low exploitation likelihood.
SQL injection vulnerability in PHPGurukul Maid Hiring Management System 1.0 affecting the /admin/search-booking-request.php file, where unsanitized user input in the 'searchdata' parameter allows unauthenticated remote attackers to execute arbitrary SQL queries. With a CVSS score of 7.3 and publicly disclosed exploit code available, this vulnerability poses significant risk to confidentiality, integrity, and availability of affected systems. Active exploitation is likely given the public POC availability and network-accessible attack vector.
SQL injection in PHPGurukul Nipah Virus Testing Management System 1.0 allows a remote, low-privileged attacker to inject SQL commands via the 'assignto' parameter of /test-details.php, potentially reading or modifying database contents. Public exploit code is available, but the EPSS score of 0.09% (25th percentile) suggests very low probability of widespread exploitation. The vulnerability has not been added to CISA's KEV catalog, indicating no known active exploitation.
SQL injection in PHPGurukul Nipah Virus Testing Management System 1.0 allows authenticated remote attackers to extract database contents via the searchdata parameter in /patient-report.php. A public exploit exists, but no active exploitation has been confirmed (EPSS 0.06%).
Critical SQL injection vulnerability in PHPGurukul BP Monitoring Management System version 1.0, specifically in the /registration.php file's emailid parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, creating immediate risk for unpatched installations.
SQL injection vulnerability in PHPGurukul Employee Record Management System 1.3 allows remote authenticated attackers to manipulate the AdminName parameter in /admin/adminprofile.php, potentially exposing or modifying database contents. A public proof-of-concept exploit exists, though EPSS scores indicate a low probability of widespread exploitation (0.06%).
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated attackers to execute arbitrary SQL commands via the delid parameter in /admin/allemployees.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated remote attackers to manipulate database queries via the 'emp3ctc' parameter in /myexp.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).
SQL injection in PHPGurukul Employee Record Management System 1.3 allows remote authenticated attackers to manipulate the 'emp3workduration' parameter in /editmyexp.php, potentially leading to data exfiltration or modification. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated attackers to manipulate the newpassword parameter in /resetpassword.php, potentially leading to unauthorized data access or modification. A public exploit exists, but no active exploitation has been confirmed.
SQL injection in PHPGurukul BP Monitoring Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 'memberage' parameter in /edit-family-member.php. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating limited exploitation likelihood.
Critical SQL injection vulnerability in PHPGurukul Local Services Search Engine Management System version 2.1, specifically in the /admin/edit-person-detail.php file where the 'editid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and may be actively exploited in the wild.
A vulnerability, which was classified as critical, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /admin/manage-card.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in PHPGurukul Medical Card Generation System 1.0. This vulnerability affects unknown code of the file /admin/unreadenq.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in PHPGurukul Medical Card Generation System 1.0. This affects an unknown part of the file /admin/readenq.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Critical SQL injection vulnerability in PHPGurukul Auto Taxi Stand Management System version 1.0, specifically in the /admin/search-autoortaxi.php file's 'searchdata' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept code available, creating immediate risk of active exploitation.
A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 2.0. Affected by this issue is some unknown functionality of the file /user/register-complaint.php. The manipulation of the argument noc leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in PHPGurukul Complaint Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /user/profile.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function of the file /admin/updatecomplaint.php. The manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-category.php. The manipulation of the argument description leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument subcategory leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-state.php. The manipulation of the argument description leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/between-date-userreport.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function of the file /admin/between-date-complaintreport.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Critical SQL injection vulnerability in PHPGurukul Notice Board System 1.0 affecting the /forgot-password.php endpoint via the email parameter. An unauthenticated remote attacker can exploit this with low complexity to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the underlying database. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
A vulnerability has been found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. This vulnerability affects unknown code of the file /admin/edit-team.php. The manipulation of the argument teamid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/manage-teams.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /details.php. The manipulation of the argument requestid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /request-details.php. The manipulation of the argument requestid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /reporting.php. The manipulation of the argument fullname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the emp1ctc parameter in /editmyexp.php. An unauthenticated remote attacker can manipulate this parameter to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion. With a publicly disclosed exploit and CVSS 7.3 rating reflecting network-based remote exploitation with low attack complexity and no authentication requirements, this vulnerability poses significant risk to exposed instances.
A critical SQL injection vulnerability exists in PHPGurukul Dairy Farm Shop Management System version 1.3 within the /search-product.php endpoint, specifically in the 'productname' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the database. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /sales-report-details.php file affecting the fromdate and todate parameters. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working proof-of-concept code available, making active exploitation likely in the wild.
SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /profile.php file's mobilenumber parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and carries a CVSS score of 7.3 (high severity), though the actual exploitability depends on database configuration and input filtering implementation.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /bwdate-report-details.php file where the fromdate and todate parameters are inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /add-product.php file's productname parameter that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for all exposed installations. With a CVSS score of 7.3 (High) and evidence of public disclosure, this vulnerability should be prioritized for remediation despite the moderate CVSS rating.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /add-company.php file where the 'companyname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data theft, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly increasing real-world exploitation risk.
A vulnerability classified as critical has been found in PHPGurukul Notice Board System 1.0. This affects an unknown part of the file /search-notice.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System 1.0 affecting the /admin/edit-category-detail.php endpoint. An unauthenticated remote attacker can manipulate the 'editid' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation highly likely.
Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System version 1.0, specifically in the /admin/view-pass-detail.php file where the 'viewid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with proof-of-concept code available, making it actively exploitable in the wild.
Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System version 1.0, where unsanitized input in the 'searchdata' parameter of /index.php allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, enabling attackers to extract sensitive data, modify records, or potentially execute system commands depending on database permissions and backend configuration. This represents an immediate threat to organizations using this system.
A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/changeimage.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-course.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, was found in PHPGurukul Teacher Subject Allocation Management System 1.0. This affects an unknown part of the file /admin/edit-teacher-info.php. The manipulation of the argument editid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, has been found in PHPGurukul Rail Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate the awarddetails parameter in /admin/add-artist.php, potentially leading to data breach or system compromise. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage4.php. Public exploit code exists, increasing risk for instances with admin panel exposure.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage3.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage2.php. A public exploit is available, but no active exploitation has been reported (EPSS 0.08%).
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate database queries via the editid parameter in /admin/changeimage1.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage.php. A public exploit is available, but no active exploitation has been reported. The EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to manipulate the imageid parameter in /admin/changepropic.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the 'editid' parameter in /admin/edit-art-medium-detail.php. Public exploit code is available, increasing the risk of targeted attacks.
CVE-2025-6409 is a critical SQL injection vulnerability in PHPGurukul Art Gallery Management System 1.1 affecting the /admin/forgot-password.php endpoint. An unauthenticated remote attacker can manipulate the 'email' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with proof-of-concept availability, making it actively exploitable in the wild.
SQL injection in PHPGurukul Directory Management System 2.0 allows authenticated attackers to manipulate the adminname parameter in /admin/admin-profile.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been confirmed.
SQL injection in PHPGurukul Directory Management System 2.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-directory.php. A public exploit is available, increasing the risk of exploitation, though EPSS score is low (0.06%).
SQL injection in PHPGurukul Directory Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-directory.php. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
CVE-2025-6330 is a critical SQL injection vulnerability in PHPGurukul Directory Management System version 1.0, specifically in the /searchdata.php file's 'searchdata' parameter. An unauthenticated remote attacker can inject arbitrary SQL commands to compromise confidentiality, integrity, and availability of the underlying database. Public disclosure and proof-of-concept exploitation have occurred, making this an immediately actionable threat despite the moderate CVSS 7.3 score.
CVE-2025-6323 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, specifically affecting the /enrollment.php file's 'fathername' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the enrollment database. The vulnerability has public proof-of-concept code available and may be actively exploited in the wild.
CVE-2025-6322 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /visit.php file's 'gname' parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and confirmed POC availability significantly elevate real-world exploitation risk.
SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers with sub-admin privileges to execute arbitrary SQL commands via the sadminusername parameter in /admin/add-subadmin.php. Public exploit code is available, increasing risk for unpatched installations.
SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers to manipulate the classname parameter in /admin/add-class.php, potentially leading to data leakage or modification. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating low exploitation likelihood.
SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers to manipulate the tsubject parameter in /admin/add-teacher.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.
CVE-2025-6318 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /admin/check_availability.php file where the 'Username' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure of exploitation details and confirmed POC availability indicate active exploitation risk in the wild.
A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.
SQL injection in PHPGurukul Emergency Ambulance Hiring Portal 1.0 allows authenticated attackers to execute arbitrary SQL commands via the 'ambregnum' parameter in /admin/add-ambulance.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Emergency Ambulance Hiring Portal 1.0 allows authenticated attackers to manipulate database queries via the fromdate/todate parameters in /admin/bwdates-request-report-details.php. Public exploit code exists, but EPSS score is low (0.06%) and no active exploitation has been reported.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Open redirect vulnerability in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to redirect users to arbitrary external sites via the 'q' parameter in /search-report-result.php. The exploit has been publicly disclosed, increasing risk of phishing attacks. EPSS score is low (0.04%), indicating low exploitation likelihood in the wild.
Cross-site scripting (XSS) in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in /search-report-result.php. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site request forgery in PHPGurukul Car Rental Portal 3.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but exploitation requires user interaction and no active exploitation has been confirmed.
Critical SQL injection vulnerability in PHPGurukul Nipah Virus Testing Management System version 1.0, located in the /registered-user-testing.php file where the 'testtype' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk in production environments.
SQL injection in PHPGurukul Nipah Virus Testing Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the testtype parameter in /bwdates-report-ds.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating limited exploitation likelihood.
Critical SQL injection vulnerability in PHPGurukul Hostel Management System 1.0 affecting the login functionality (/includes/login-hm.inc.php). An unauthenticated attacker can manipulate the Username parameter to execute arbitrary SQL queries remotely, potentially compromising data confidentiality, integrity, and availability. Public exploit disclosure and active exploitation potential significantly elevate real-world risk despite a moderate CVSS score of 7.3.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
Stored cross-site scripting in PHPGurukul Nipah Virus Testing Management System 1.0 allows authenticated attackers to inject arbitrary web scripts via the 'serachdata' parameter in /search-report.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the Name parameter in /contact.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.05%), indicating low exploitation likelihood.
Stored cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the 'pagedes' parameter in /admin/aboutus.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Stored cross-site scripting in PHPGurukul Rail Pass Management System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the 'fullname' parameter in /admin/add-pass.php. The exploit has been publicly disclosed, increasing the risk of targeted attacks against administrative users.
Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the searchdata parameter in /rpms/download-pass.php. The vulnerability is publicly exploited with a disclosed proof-of-concept, though EPSS score is low (0.07%), indicating limited active exploitation.
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the searchdata parameter in /check-status.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated attackers with high privileges to inject arbitrary web script via the tableno parameter in the admin add-table page, enabling data manipulation or session theft when another administrator views the tainted content. No active exploitation has been confirmed, but a public proof-of-concept is available.
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the fullname parameter in /admin/manage-subadmins.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the 'fullname' parameter in /admin/add-subadmin.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating low exploitation likelihood.
SQL injection vulnerability in PHPGurukul Maid Hiring Management System 1.0 affecting the /admin/search-booking-request.php file, where unsanitized user input in the 'searchdata' parameter allows unauthenticated remote attackers to execute arbitrary SQL queries. With a CVSS score of 7.3 and publicly disclosed exploit code available, this vulnerability poses significant risk to confidentiality, integrity, and availability of affected systems. Active exploitation is likely given the public POC availability and network-accessible attack vector.
SQL injection in PHPGurukul Nipah Virus Testing Management System 1.0 allows a remote, low-privileged attacker to inject SQL commands via the 'assignto' parameter of /test-details.php, potentially reading or modifying database contents. Public exploit code is available, but the EPSS score of 0.09% (25th percentile) suggests very low probability of widespread exploitation. The vulnerability has not been added to CISA's KEV catalog, indicating no known active exploitation.
SQL injection in PHPGurukul Nipah Virus Testing Management System 1.0 allows authenticated remote attackers to extract database contents via the searchdata parameter in /patient-report.php. A public exploit exists, but no active exploitation has been confirmed (EPSS 0.06%).
Critical SQL injection vulnerability in PHPGurukul BP Monitoring Management System version 1.0, specifically in the /registration.php file's emailid parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, creating immediate risk for unpatched installations.
SQL injection vulnerability in PHPGurukul Employee Record Management System 1.3 allows remote authenticated attackers to manipulate the AdminName parameter in /admin/adminprofile.php, potentially exposing or modifying database contents. A public proof-of-concept exploit exists, though EPSS scores indicate a low probability of widespread exploitation (0.06%).
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated attackers to execute arbitrary SQL commands via the delid parameter in /admin/allemployees.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated remote attackers to manipulate database queries via the 'emp3ctc' parameter in /myexp.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).
SQL injection in PHPGurukul Employee Record Management System 1.3 allows remote authenticated attackers to manipulate the 'emp3workduration' parameter in /editmyexp.php, potentially leading to data exfiltration or modification. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated attackers to manipulate the newpassword parameter in /resetpassword.php, potentially leading to unauthorized data access or modification. A public exploit exists, but no active exploitation has been confirmed.
SQL injection in PHPGurukul BP Monitoring Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 'memberage' parameter in /edit-family-member.php. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating limited exploitation likelihood.
Critical SQL injection vulnerability in PHPGurukul Local Services Search Engine Management System version 2.1, specifically in the /admin/edit-person-detail.php file where the 'editid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and may be actively exploited in the wild.
A vulnerability, which was classified as critical, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /admin/manage-card.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in PHPGurukul Medical Card Generation System 1.0. This vulnerability affects unknown code of the file /admin/unreadenq.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in PHPGurukul Medical Card Generation System 1.0. This affects an unknown part of the file /admin/readenq.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Critical SQL injection vulnerability in PHPGurukul Auto Taxi Stand Management System version 1.0, specifically in the /admin/search-autoortaxi.php file's 'searchdata' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept code available, creating immediate risk of active exploitation.
A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 2.0. Affected by this issue is some unknown functionality of the file /user/register-complaint.php. The manipulation of the argument noc leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in PHPGurukul Complaint Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /user/profile.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function of the file /admin/updatecomplaint.php. The manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-category.php. The manipulation of the argument description leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument subcategory leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-state.php. The manipulation of the argument description leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/between-date-userreport.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function of the file /admin/between-date-complaintreport.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Critical SQL injection vulnerability in PHPGurukul Notice Board System 1.0 affecting the /forgot-password.php endpoint via the email parameter. An unauthenticated remote attacker can exploit this with low complexity to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the underlying database. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
A vulnerability has been found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. This vulnerability affects unknown code of the file /admin/edit-team.php. The manipulation of the argument teamid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/manage-teams.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /details.php. The manipulation of the argument requestid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /request-details.php. The manipulation of the argument requestid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /reporting.php. The manipulation of the argument fullname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the emp1ctc parameter in /editmyexp.php. An unauthenticated remote attacker can manipulate this parameter to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion. With a publicly disclosed exploit and CVSS 7.3 rating reflecting network-based remote exploitation with low attack complexity and no authentication requirements, this vulnerability poses significant risk to exposed instances.
A critical SQL injection vulnerability exists in PHPGurukul Dairy Farm Shop Management System version 1.3 within the /search-product.php endpoint, specifically in the 'productname' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the database. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /sales-report-details.php file affecting the fromdate and todate parameters. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working proof-of-concept code available, making active exploitation likely in the wild.
SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /profile.php file's mobilenumber parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and carries a CVSS score of 7.3 (high severity), though the actual exploitability depends on database configuration and input filtering implementation.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /bwdate-report-details.php file where the fromdate and todate parameters are inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /add-product.php file's productname parameter that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for all exposed installations. With a CVSS score of 7.3 (High) and evidence of public disclosure, this vulnerability should be prioritized for remediation despite the moderate CVSS rating.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /add-company.php file where the 'companyname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data theft, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly increasing real-world exploitation risk.
A vulnerability classified as critical has been found in PHPGurukul Notice Board System 1.0. This affects an unknown part of the file /search-notice.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System 1.0 affecting the /admin/edit-category-detail.php endpoint. An unauthenticated remote attacker can manipulate the 'editid' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation highly likely.
Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System version 1.0, specifically in the /admin/view-pass-detail.php file where the 'viewid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with proof-of-concept code available, making it actively exploitable in the wild.
Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System version 1.0, where unsanitized input in the 'searchdata' parameter of /index.php allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, enabling attackers to extract sensitive data, modify records, or potentially execute system commands depending on database permissions and backend configuration. This represents an immediate threat to organizations using this system.
A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/changeimage.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-course.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, was found in PHPGurukul Teacher Subject Allocation Management System 1.0. This affects an unknown part of the file /admin/edit-teacher-info.php. The manipulation of the argument editid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, has been found in PHPGurukul Rail Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.