CVE-2025-2646

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Art Gallery Management System	1.0

References

https://github.com/liuhao2638/cve/issues/9Exploit, Issue Tracking, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.300661Permissions Required, VDB Entry
https://vuldb.com/?id.300661Third Party Advisory, VDB Entry
https://vuldb.com/?submit.519776Third Party Advisory, VDB Entry
https://github.com/liuhao2638/cve/issues/9Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Mar 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-264613.3In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to clos CVE-2025-264627.8In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code. This could lead to CVE-2025-264635.5In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This could lead to a local CVE-2025-264647.8In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This CVE-2025-264656.8A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malic CVE-2025-264665.9A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and sto CVE-2025-264678.8Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privil CVE-2025-264687.5CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition o CVE-2025-264699.8An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3 CVE-2025-26479.8A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been rated as critical. Affected by this issue is some unk CVE-2025-264706.7Incorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may allow an authenticat CVE-2025-264725.7Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow