CVE-2025-2683

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-26849.8A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. This issue affects some uCVE-2025-268416.1Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.CVE-2025-268427.5An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visibCVE-2025-268449.8An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.CVE-2025-268459.8An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a CVE-2025-268469.8An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadaCVE-2025-268477.5An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.CVE-2025-268494.3There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventoCVE-2025-26855.4The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameCVE-2025-268509.3The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation CVE-2025-268529.8DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.CVE-2025-268539.8DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.