CVE-2025-25462

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote attackers to execute arbitrary code via the propertytype POST request parameter.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/terrasystemlabs/CVE-IDs/blob/main/PHP-Gurukul/Land-record/Land_SQL_Injection.pdfExploit, Third Party Advisory

Timeline

Published: Feb 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-254679.8Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a CVE-2025-254686.5FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.CVE-2025-254698.8FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.CVE-2025-25474.3A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unkno CVE-2025-254714.3FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c.CVE-2025-254725.3A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file.CVE-2025-254735.3FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.CVE-2025-254746.5DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h.CVE-2025-254757.5A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via CVE-2025-254765.4A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Jav CVE-2025-254778.1A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be CVE-2025-254786.5The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to