CVE-2025-10603

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in PHPGurukul Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_forum/search_result.php. Executing manipulation of the argument Search can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Online Discussion Forum	1.0

References

https://github.com/maximdevere/cve/issues/1Exploit, Issue Tracking
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.324623Permissions Required, VDB Entry
https://vuldb.com/?id.324623Third Party Advisory, VDB Entry
https://vuldb.com/?submit.649867Third Party Advisory, VDB Entry
https://github.com/maximdevere/cve/issues/1Exploit, Issue Tracking

Timeline

Published: Sep 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-106049.8A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. This affects an unknown part of the file /admin/edit_member.php. T CVE-2025-106056.1A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agenda_preferenc CVE-2025-106066.1A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuraca CVE-2025-106076.5A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/CVE-2025-106088.8A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/CVE-2025-106095.9Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This CVE-2025-10619.8The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is d CVE-2025-106109.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing CVE-2025-106119.8Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST API CVE-2025-106126.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies CVE-2025-106138.8A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leve CVE-2025-106146.1A vulnerability was determined in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 on COVID. This affects an unknown fu