← Vulnerability feed

Vulnerability record · CVE-2025-4873 · published 18 May 2025

CVE-2025-4873: Phpgurukul news portal injection vulnerability

Phpgurukul · News Portal

A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

6.9 CVSS 4.0 Medium EPSS 0.58% · top 54.4% CWE-74 · InjectionCWE-89 · SQL injection
6.9CVSS 4.0 base score, v2 7.5
0.58%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Schatten-42/MyCVE/issues/6 ExploitThird Party Advisory
https://phpgurukul.com/ Product
https://vuldb.com/?ctiid.309415 Permissions Required
https://vuldb.com/?id.309415 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.576244 Third Party AdvisoryVDB Entry
https://github.com/Schatten-42/MyCVE/issues/6 ExploitThird Party Advisory

Track CVE-2025-4873 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-69991Phpgurukul news portal sql injection vulnerabilityphpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.EPSS 0.46%9.8CVE-2025-69992Phpgurukul news portal out-of-bounds read vulnerabilityphpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server witho…EPSS 0.59%9.1CVE-2025-69990Phpgurukul news portal vulnerabilityphpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be dele…EPSS 0.45%6.9CVE-2025-4880Phpgurukul news portal injection vulnerabilityA vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality o…EPSS 0.58%6.9CVE-2025-4874Phpgurukul news portal injection vulnerabilityA vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of t…EPSS 0.58%6.9CVE-2025-1859Phpgurukul news portal injection vulnerabilityA vulnerability, which was classified as critical, has been found in PHPGurukul News Portal 4.1. This issue affects some unknown processing of the fi…EPSS 0.49%5.9CVE-2021-37808Phpgurukul news portal sql injection vulnerabilitySQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, an…EPSS 1.8%2.9CVE-2025-12616Phpgurukul news portal information exposure vulnerabilityA vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a m…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2025-4873), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.