← Vulnerability feed

Vulnerability record · CVE-2025-1859 · published 3 March 2025

CVE-2025-1859: Phpgurukul news portal injection vulnerability

Phpgurukul · News Portal

A vulnerability, which was classified as critical, has been found in PHPGurukul News Portal 4.1. This issue affects some unknown processing of the file /login.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

6.9 CVSS 4.0 Medium EPSS 0.49% · top 60.3% CWE-74 · InjectionCWE-89 · SQL injection
6.9CVSS 4.0 base score, v2 7.5
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul News Portal 4.1. This issue affects some unknown processing of the file /login.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/panghuanjie/Code-audits/issues/2 ExploitIssue Tracking
https://phpgurukul.com/ Product
https://vuldb.com/?ctiid.298127 Permissions RequiredVDB Entry
https://vuldb.com/?id.298127 Permissions RequiredVDB Entry
https://vuldb.com/?submit.506350 Third Party AdvisoryVDB Entry

Track CVE-2025-1859 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-69991Phpgurukul news portal sql injection vulnerabilityphpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.EPSS 0.46%9.8CVE-2025-69992Phpgurukul news portal out-of-bounds read vulnerabilityphpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server witho…EPSS 0.59%9.1CVE-2025-69990Phpgurukul news portal vulnerabilityphpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be dele…EPSS 0.45%6.9CVE-2025-4880Phpgurukul news portal injection vulnerabilityA vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality o…EPSS 0.58%6.9CVE-2025-4873Phpgurukul news portal injection vulnerabilityA vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality o…EPSS 0.58%6.9CVE-2025-4874Phpgurukul news portal injection vulnerabilityA vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of t…EPSS 0.58%5.9CVE-2021-37808Phpgurukul news portal sql injection vulnerabilitySQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, an…EPSS 1.8%2.9CVE-2025-12616Phpgurukul news portal information exposure vulnerabilityA vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a m…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2025-1859), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.