CVE-2025-2644

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Art Gallery Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/add-art-product.php. The manipulation of the argument arttype leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-264407.8In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This CVE-2025-264416.5In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informationCVE-2025-264425.5In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due tCVE-2025-264437.3In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to CVE-2025-264447.8In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the defaultCVE-2025-264455.5In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead tCVE-2025-264485.5In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local informationCVE-2025-264495.5In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of servicCVE-2025-26456.1A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. Affected is an unknown funCVE-2025-264507.8In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defaCVE-2025-264527.8In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. ThiCVE-2025-264535.5In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. Thi
CVE-2025-2644: Critical severity, CVSS 9.8 | Vulnix