CVE Intelligence
Analysis AI-assisted

CVE-2025-11416: PHPGurukul Beauty Parlour Management System SQL Injection in invoices.php

A SQL injection flaw has been reported in PHPGurukul Beauty Parlour Management System version 1.1, in the /admin/invoices.php file through the delid argument. The record describes the issue as remotely exploitable and states that an exploit has been publicly released. NVD lists a CVSS 3.1 base score of 9.8 (critical), while no confirmed exploitation in the wild appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-11416 describes an SQL injection weakness (CWE-74, Injection) in the administrative invoices page of PHPGurukul Beauty Parlour Management System 1.1. According to the record, manipulating the delid argument of /admin/invoices.php can alter database queries. The CNA is VulDB and the record was last modified in the NVD.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network reachability, low complexity, no privileges or user interaction, and high confidentiality, integrity and availability impact.
  • VulDB provides lower alternative scores, including 7.3 (CVSS 3.1) and 6.9 (CVSS 4.0), so scoring differs by source.
  • The SSVC data indicates partial technical impact and that the issue is automatable.

Affected products and versions

  • Product: PHPGurukul Beauty Parlour Management System, version 1.1.
  • The record lists no fixed version. Vendor product information is available at phpgurukul.com.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed by KEV.
  • The record states that an exploit has been publicly released and that the SSVC exploitation status is poc (proof of concept). The public issue is referenced at GitHub issue 4.
  • EPSS shows a probability of 0.00417 (percentile 0.34194).

Remediation and mitigation

  • No vendor fix is listed in the record. Administrators should check with the vendor for an updated release or apply a fix if one becomes available.
  • Until a fix is confirmed, restrict access to the administrative area, limit exposure of the application to untrusted networks, and review whether the invoices module is needed.
  • Validate and parameterize database queries in any custom modifications to the affected code.

Detection guidance

  • Review web server and application logs for unusual values in the delid parameter on invoices.php, especially malformed or unexpected characters and repeated requests.
  • Monitor database errors that originate from the invoices page.
  • Inventory deployments of this application to identify all instances of version 1.1.

Limitations of the available information

  • The record does not identify the specific vulnerable code change or a fixed version.
  • Scores differ across NVD and VulDB records, and the record does not explain the differences.
  • The exact scope of data accessible through the injection is not described.
  • EPSS values are probabilistic estimates and do not confirm exploitation.

Frequently asked questions

Is CVE-2025-11416 known to be actively exploited?

The record does not list this CVE in the CISA KEV catalog, so active exploitation is not confirmed. The record does state that a public exploit has been released and marks SSVC exploitation as poc.

Which version is affected?

The record lists PHPGurukul Beauty Parlour Management System version 1.1. No fixed version is listed.

What is the severity score?

NVD lists a CVSS 3.1 base score of 9.8 (critical). VulDB provides different scores, including 7.3 under CVSS 3.1 and 6.9 under CVSS 4.0.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.