Student Record System
Monthly
A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. [CVSS 2.4 LOW]
A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-course.php. [CVSS 2.4 LOW]
A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in PHPGurukul Student Record System 3.2 allows authenticated low-privilege users to manipulate database queries via the 'session' parameter in /register.php, potentially leading to data theft or modification. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates very low likelihood (0.04%).
SQL injection in PHPGurukul Student Record System 3.2 enables authenticated remote attackers to manipulate database queries via the fmarks2 parameter in /edit-student.php, potentially leading to data exposure or modification. Exploit code is publicly available, but the low EPSS score (0.04%) and required low-privilege authentication limit immediate real-world risk.
Remote SQL injection in PHPGurukul Student Record System 3.2 allows authenticated attackers to manipulate the aemailid parameter via /admin-profile.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation (CISA KEV) or vendor patch has been confirmed at this time.
We need to produce a JSON object with all the specified fields. The input data: CVE-2025-6912, PHPGurukul Student Record System 3.2, SQL injection in /manage-students.php via del parameter. CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P ... So attack vector network, low complexity, privileges required low (PR:L), user interaction none, vulnerable system impact low on confidentiality, integrity, availability. Exploit maturity is Proof-of-Concept (E:P). The CVSS score is 2.1? That's very low. But it says rated as critical in the description, but CVSS 2.1 is low. The description says rated as critical, but CVSS base score might be different; we'll use the provided CVSS vector to assess. EPSS 0.04% percentile 13% - low. No KEV listing. POC is publicly available (from description and tags). No patch data provided. We'll synthesize. product_name: "Student Record System" (as specific product, from CPE: phpGurukul Student Record System, so "Student Record System" or "PHPGurukul Student Record System"? The instruction: 1-3 words ONLY. The specific product or service name affected. "Student Record System" is fine, maybe "PHPGurukul Student Record System" too many words? 3 words: "PHPGurukul Student Record System"? Actually "PHPGurukul Student Record System" is 4 words. I can simplify to "Student Record System" because the vendor is known, but we must be specific. The CPE says phpGurukul:student_record_system. So product name: "Student Record System". I'll go with "Student Record System". But to be clear: "PHPGurukul Student Record System" might be too long. I'll go "PHPGurukul Student Record System" (3 words if I count: PHPGurukul, Student, Record, System? Actually "PHPGurukul" is one word, "Student Record System" three, total 4. I could do "Student Record System" alone. The CVE description says "PHPGurukul Student Record System 3.2". That's the product. The vendor is PHPGurukul, product Student Record System. So I'll put "Student
SQL injection in the 'del' parameter of /manage-subjects.php in PHPGurukul Student Record System 3.2 allows authenticated, low-privilege remote attackers to manipulate the backend database. Public exploit code is available, though EPSS exploitation probability is low (0.04%) and active exploitation by CISA KEV is not confirmed.
SQL injection in PHPGurukul Student Record System 3.2 via /session.php allows authenticated remote attackers to manipulate the session parameter to execute arbitrary SQL commands, leading to potential data theft or tampering. A public proof-of-concept exploit is available, though no active exploitation has been confirmed. The affected system is a niche academic management platform, reducing widespread risk.
A SQL injection vulnerability in Student Record system Using PHP and MySQL v (CVSS 7.1) that allows a remote attacker. High severity vulnerability requiring prompt remediation.
A vulnerability classified as critical was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Record System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Record System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Record System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Student Record System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid parameter to edit-sub.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit-std.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid parameter to edit-course.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. [CVSS 2.4 LOW]
A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-course.php. [CVSS 2.4 LOW]
A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in PHPGurukul Student Record System 3.2 allows authenticated low-privilege users to manipulate database queries via the 'session' parameter in /register.php, potentially leading to data theft or modification. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates very low likelihood (0.04%).
SQL injection in PHPGurukul Student Record System 3.2 enables authenticated remote attackers to manipulate database queries via the fmarks2 parameter in /edit-student.php, potentially leading to data exposure or modification. Exploit code is publicly available, but the low EPSS score (0.04%) and required low-privilege authentication limit immediate real-world risk.
Remote SQL injection in PHPGurukul Student Record System 3.2 allows authenticated attackers to manipulate the aemailid parameter via /admin-profile.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation (CISA KEV) or vendor patch has been confirmed at this time.
We need to produce a JSON object with all the specified fields. The input data: CVE-2025-6912, PHPGurukul Student Record System 3.2, SQL injection in /manage-students.php via del parameter. CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P ... So attack vector network, low complexity, privileges required low (PR:L), user interaction none, vulnerable system impact low on confidentiality, integrity, availability. Exploit maturity is Proof-of-Concept (E:P). The CVSS score is 2.1? That's very low. But it says rated as critical in the description, but CVSS 2.1 is low. The description says rated as critical, but CVSS base score might be different; we'll use the provided CVSS vector to assess. EPSS 0.04% percentile 13% - low. No KEV listing. POC is publicly available (from description and tags). No patch data provided. We'll synthesize. product_name: "Student Record System" (as specific product, from CPE: phpGurukul Student Record System, so "Student Record System" or "PHPGurukul Student Record System"? The instruction: 1-3 words ONLY. The specific product or service name affected. "Student Record System" is fine, maybe "PHPGurukul Student Record System" too many words? 3 words: "PHPGurukul Student Record System"? Actually "PHPGurukul Student Record System" is 4 words. I can simplify to "Student Record System" because the vendor is known, but we must be specific. The CPE says phpGurukul:student_record_system. So product name: "Student Record System". I'll go with "Student Record System". But to be clear: "PHPGurukul Student Record System" might be too long. I'll go "PHPGurukul Student Record System" (3 words if I count: PHPGurukul, Student, Record, System? Actually "PHPGurukul" is one word, "Student Record System" three, total 4. I could do "Student Record System" alone. The CVE description says "PHPGurukul Student Record System 3.2". That's the product. The vendor is PHPGurukul, product Student Record System. So I'll put "Student
SQL injection in the 'del' parameter of /manage-subjects.php in PHPGurukul Student Record System 3.2 allows authenticated, low-privilege remote attackers to manipulate the backend database. Public exploit code is available, though EPSS exploitation probability is low (0.04%) and active exploitation by CISA KEV is not confirmed.
SQL injection in PHPGurukul Student Record System 3.2 via /session.php allows authenticated remote attackers to manipulate the session parameter to execute arbitrary SQL commands, leading to potential data theft or tampering. A public proof-of-concept exploit is available, though no active exploitation has been confirmed. The affected system is a niche academic management platform, reducing widespread risk.
A SQL injection vulnerability in Student Record system Using PHP and MySQL v (CVSS 7.1) that allows a remote attacker. High severity vulnerability requiring prompt remediation.
A vulnerability classified as critical was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.20. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Record System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Record System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Record System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Student Record System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid parameter to edit-sub.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit-std.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid parameter to edit-course.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.