CVE-2025-2641

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-artist-detail.php?editid=1. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Art Gallery Management System	1.0

References

https://github.com/liuhao2638/cve/issues/2Exploit, Issue Tracking, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.300656Permissions Required, VDB Entry
https://vuldb.com/?id.300656Third Party Advisory, VDB Entry
https://vuldb.com/?submit.519768Third Party Advisory, VDB Entry
https://github.com/liuhao2638/cve/issues/2Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Mar 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-264109.8The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovere CVE-2025-264118.8An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python CVE-2025-264126.8The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on t CVE-2025-264137.5Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer an CVE-2025-264169.8In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to r CVE-2025-264174.0In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage CVE-2025-264187.8In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to CVE-2025-264193.3In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local CVE-2025-26429.8A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part o CVE-2025-264204.4In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission du CVE-2025-264214.0In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privi CVE-2025-264224.0In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission