Vulnerability record · CVE-2025-12616 · published 3 November 2025

CVE-2025-12616: Phpgurukul news portal information exposure vulnerability

Phpgurukul · News Portal

A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.

2.9 CVSS 4.0 Low EPSS 0.54% · top 56.7% CWE-200 · Information exposureCWE-215 · CWE-215

2.9CVSS 4.0 base score, v2 2.6

0.54%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

News Portal Phpgurukul

References

Link	Tags
https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%2	ExploitThird Party Advisory
https://phpgurukul.com/	Product
https://vuldb.com/?ctiid.330910	Permissions RequiredVDB Entry
https://vuldb.com/?id.330910	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.678649	Third Party AdvisoryVDB Entry
https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%2	ExploitThird Party Advisory

Track CVE-2025-12616 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-69991Phpgurukul news portal sql injection vulnerabilityphpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.EPSS 0.46%13 Jan 2026 9.8CVE-2025-69992Phpgurukul news portal out-of-bounds read vulnerabilityphpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server witho…EPSS 0.59%13 Jan 2026 9.1CVE-2025-69990Phpgurukul news portal vulnerabilityphpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be dele…EPSS 0.45%13 Jan 2026 6.9CVE-2025-4880Phpgurukul news portal injection vulnerabilityA vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality o…EPSS 0.58%18 May 2025 6.9CVE-2025-4873Phpgurukul news portal injection vulnerabilityA vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality o…EPSS 0.58%18 May 2025 6.9CVE-2025-4874Phpgurukul news portal injection vulnerabilityA vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of t…EPSS 0.58%18 May 2025 6.9CVE-2025-1859Phpgurukul news portal injection vulnerabilityA vulnerability, which was classified as critical, has been found in PHPGurukul News Portal 4.1. This issue affects some unknown processing of the fi…EPSS 0.49%3 Mar 2025 5.9CVE-2021-37808Phpgurukul news portal sql injection vulnerabilitySQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, an…EPSS 1.8%27 Oct 2021

Source: NIST National Vulnerability Database (record CVE-2025-12616), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.