114
CVEs
7
Critical
5
High
0
KEV
108
PoC
12
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
7
HIGH
5
MEDIUM
57
LOW
45
Monthly CVE Trend
Affected Products (30)
PHP
949
Hospital Management System
41
Zoo Management System
36
Art Gallery Management System
36
Complaint Management System
32
Online Shopping Portal
32
Online Fire Reporting System
32
Student Record System
29
Beauty Parlour Management System
28
User Registration Login And User Management System
25
Land Record System
25
Vehicle Parking Management System
24
Pre School Enrollment System
24
Dairy Farm Shop Management System
23
Old Age Home Management System
21
Nipah Virus Testing Management System
20
Apartment Visitors Management System
20
Park Ticketing Management System
20
Cyber Cafe Management System
19
Covid19 Testing Management System
19
Small Crm
19
Boat Booking System
18
Bank Locker Management System
18
Men Salon Management System
17
Restaurant Table Booking System
17
Directory Management System
17
Emergency Ambulance Hiring Portal
17
Online Nurse Hiring System
17
Employee Record Management System
16
Hostel Management System
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-56074 | A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2025-57119 | An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2025-69992 | phpgurukul News Portal V4.1 allows unauthenticated upload of any file type via upload.php. The third critical vulnerability in this application alongside file deletion and SQL injection. PoC available. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2025-69991 | phpgurukul News Portal V4.1 has SQL injection in check_availablity.php. PoC available. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-70892 | Phpgurukul Cyber Cafe Management System v1.0 has SQL injection in the username parameter of add-users.php. PoC available. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-69990 | phpgurukul News Portal V4.1 allows unauthenticated arbitrary file deletion via remove_file.php. Attackers can delete any file on the server. PoC available. | CRITICAL | 9.1 | 0.1% | 66 |
PoC
No patch
|
| CVE-2025-70064 | PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing to the /admin/ directory after authentication. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2024-55270 | phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.0% | 64 |
PoC
No patch
|
| CVE-2025-70893 | A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.0% | 64 |
PoC
No patch
|
| CVE-2025-63611 | Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). [CVSS 8.7 HIGH] | HIGH | 8.7 | 0.0% | 64 |
PoC
No patch
|
| CVE-2025-61096 | PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. | MEDIUM | 6.5 | 0.0% | 53 |
PoC
No patch
|
| CVE-2025-70063 | Hospital Management System versions up to 4.0 is affected by authorization bypass through user-controlled key (CVSS 6.5). | MEDIUM | 6.5 | 0.0% | 53 |
PoC
No patch
|
| CVE-2025-70899 | Online Course Registration versions up to 3.1 is affected by cross-site request forgery (csrf) (CVSS 6.5). | MEDIUM | 6.5 | 0.0% | 53 |
PoC
No patch
|
| CVE-2025-70062 | Hospital Management System versions up to 4.0 is affected by cross-site request forgery (csrf) (CVSS 6.5). | MEDIUM | 6.5 | 0.0% | 53 |
PoC
No patch
|
| CVE-2025-70890 | Cyber Cafe Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 6.1). | MEDIUM | 6.1 | 0.0% | 51 |
PoC
No patch
|