CVE-2025-15406

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862 CWE-863

Affected software

Vendor	Product	Versions
PHPGurukul	Online Course Registration	3.0; 3.1

References

https://github.com/rsecroot/Online-Course-Registration/blob/main/Broken%20Access%20Control.mdExploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.339326Permissions Required, VDB Entry
https://vuldb.com/?id.339326Third Party Advisory, VDB Entry
https://vuldb.com/?submit.728354Third Party Advisory, VDB Entry

Timeline

Published: Jan 1, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-154079.8A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category CVE-2025-154089.8A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. P CVE-2025-154099.8A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the f CVE-2025-154109.8A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /l CVE-2025-154117.8A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /CVE-2025-154127.8A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of th CVE-2025-154137.8A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m3_exec.h. Performing CVE-2025-154144.7A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.g CVE-2025-154155.4A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.CVE-2025-154165.4A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add G CVE-2025-154175.5A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/CVE-2025-154185.5A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the