Vulnerabilidades de Phpgurukul
CVEs publicadas que afetam produtos de Phpgurukul: 116 registro(s), com severidade, exploração e correções.
Student Record System 11Online Shopping Portal Project 10Beauty Parlour Management System 8News Portal 8Online Shopping Portal 7Small Crm 7Complaint Management System 6Hospital Management System 6Cyber Cafe Management System 5Online Course Registration 5Vehicle Record Management System 5News Portal Project 4Bank Locker Management System 4Hostel Management System 4Blood Donor Management System 3Curfew E-pass Management System 3Daily Expense Tracker System 3Student Record Management System 2Billing System 2Online Course Registration System 2Company Visitor Management System 2User Registration & Login and User Management System 2Student Information System 1Daily Expense Tracking System 1Maid Hiring Management System 1Directory Management System 1Staff Leave Management System 1Student Management System 1Gym Management System 1Tourism Management System 1Employee Record Management System 1
CVE-2025-12616
Média · 5.9
CWE-200 03/11/2025
PHPGurukul News Portal settings.py insertion of sensitive information into debugging code
A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
CVE-2025-12615
Alta · 8.1
CWE-320 03/11/2025
PHPGurukul News Portal settings.py hard-coded key
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key
. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
CVE-2025-12312
Média · 4.8
CWE-79 27/10/2025
PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting
A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. This manipulation of the argument Fullname/Category causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
CVE-2025-12311
Média · 4.8
CWE-79 27/10/2025
PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting
A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-category-detail.php. The manipulation of the argument catname results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
CVE-2025-12303
Média · 4.8
CWE-79 27/10/2025
PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting
A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profile.php. Executing a manipulation of the argument adminname/email can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.
CVE-2025-61255
Média · 6.1
CWE-79 21/10/2025
Cross-site Scripting (XSS) em Phpgurukul Bank Locker Management System
Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection.
CVE-2025-11507
Crítica · 9.8
CWE-74 08/10/2025
PHPGurukul Beauty Parlour Management System search-invoices.php sql injection
A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/search-invoices.php. This manipulation of the argument searchdata causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-11506
Crítica · 9.8
CWE-74 08/10/2025
PHPGurukul Beauty Parlour Management System search-appointment.php sql injection
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/search-appointment.php. The manipulation of the argument searchdata results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-11505
Crítica · 9.8
CWE-89 08/10/2025
PHPGurukul Beauty Parlour Management System new-appointment.php sql injection
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The manipulation of the argument delid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVE-2025-11503
Crítica · 9.8
CWE-89 08/10/2025
PHPGurukul Beauty Parlour Management System manage-services.php sql injection
A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-services.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2025-11416
Crítica · 9.8
CWE-74 07/10/2025
Injeção de SQL em invoices.php do PHPGurukul Beauty Parlour Management System
Foi descoberta uma falha de segurança no PHPGurukul Beauty Parlour Management System 1.1. Ela afeta uma parte não especificada do arquivo /admin/invoices.php. A manipulação do argumento delid resulta em injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi divulgado publicamente e pode ser usado em ataques.
CVE-2025-11415
Crítica · 9.8
CWE-74 07/10/2025
PHPGurukul Beauty Parlour Management System customer-list.php sql injection
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/customer-list.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVE-2025-11390
Média · 6.1
CWE-79 07/10/2025
PHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scripting
A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.php of the component POST Parameter Handler. Executing a manipulation of the argument searchdata can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-11330
Alta · 8.8
CWE-74 06/10/2025
PHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injection
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports-detail.php. Such manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-11112
Média · 6.1
CWE-79 28/09/2025
PHPGurukul Employee Record Management System myprofile.php cross site scripting
A security vulnerability has been detected in PHPGurukul Employee Record Management System 1.3. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument First name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-11053
Crítica · 9.8
CWE-89 27/09/2025
PHPGurukul Small CRM forgot-password.php sql injection
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.