Teachers Record Management System
Monthly
A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the tid parameter in /admin/changeimage.php. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is low (0.05%), indicating limited exploitation likelihood at this time.
We need to analyze CVE-2025-6885: PHPGurukul Teachers Record Management System 2.1, SQL injection in /admin/edit-teacher-detail.php via tid. Critical classification, but CVSS? Provided CVSS vector is 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... This is a base score 5.5 (medium) from the vector. But the CVSS 3.1 vector is missing. Need to generate own assessed CVSS 3.1 vector. Given PR:N, UI:N, and attack vector network, but impact low integrity, low confidentiality, low availability? Wait, VC:L, VI:L, VA:L (vulnerable system impact low for all three). So this SQL injection is low impact? But SQL injection typically can be high. Perhaps the attack is limited. The CVSS 4.0 score is from the source (probably VulDB). We'll have to synthesize. Multi-source: EPSS 0.05% (percentile 14%) - very low exploitation probability. No KEV (not in input). POC/Exploit: Publicly available (disclosed to the public). CWE-74? Actually description says sql injection (CWE-89 should be). But provided CWE is CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – generic injection. I'll use that. CPE: phpgurukul:teachers_record_management_system:2.1. Product name: "Teachers Record Management System". 1-3 words. So "Teachers Record Management System". Could be "PHPGurukul Teachers Record Management System" too long, but 1-3 words: "Teachers Record Management System" is fine. Summary: Need original synthesis. Not copy description. Mention SQL injection, remote, POC available, EPSS low, no active exploitation. Mention product and version. "Remote SQL injection in PHPGurukul Teachers Record Management System 2.1 via tid parameter in /admin/edit-teacher-detail.php allows attackers to manipulate database queries, potentially leading to data exposure or modification." Technical context: Underlying technology: PHP web application, SQL injection via parameter tid. Root cause: failure to sanitize in
Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the tid parameter in /admin/changeimage.php. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is low (0.05%), indicating limited exploitation likelihood at this time.
We need to analyze CVE-2025-6885: PHPGurukul Teachers Record Management System 2.1, SQL injection in /admin/edit-teacher-detail.php via tid. Critical classification, but CVSS? Provided CVSS vector is 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... This is a base score 5.5 (medium) from the vector. But the CVSS 3.1 vector is missing. Need to generate own assessed CVSS 3.1 vector. Given PR:N, UI:N, and attack vector network, but impact low integrity, low confidentiality, low availability? Wait, VC:L, VI:L, VA:L (vulnerable system impact low for all three). So this SQL injection is low impact? But SQL injection typically can be high. Perhaps the attack is limited. The CVSS 4.0 score is from the source (probably VulDB). We'll have to synthesize. Multi-source: EPSS 0.05% (percentile 14%) - very low exploitation probability. No KEV (not in input). POC/Exploit: Publicly available (disclosed to the public). CWE-74? Actually description says sql injection (CWE-89 should be). But provided CWE is CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – generic injection. I'll use that. CPE: phpgurukul:teachers_record_management_system:2.1. Product name: "Teachers Record Management System". 1-3 words. So "Teachers Record Management System". Could be "PHPGurukul Teachers Record Management System" too long, but 1-3 words: "Teachers Record Management System" is fine. Summary: Need original synthesis. Not copy description. Mention SQL injection, remote, POC available, EPSS low, no active exploitation. Mention product and version. "Remote SQL injection in PHPGurukul Teachers Record Management System 2.1 via tid parameter in /admin/edit-teacher-detail.php allows attackers to manipulate database queries, potentially leading to data exposure or modification." Technical context: Underlying technology: PHP web application, SQL injection via parameter tid. Root cause: failure to sanitize in
Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.