CVE-2025-4060

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the file /category.php. The manipulation of the argument catname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-406009.8Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause CVE-2025-406017.5A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Servic CVE-2025-406026.6A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).CVE-2025-406034.5A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administr CVE-2025-406049.8Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verify CVE-2025-406055.3A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by inj CVE-2025-40617.8A vulnerability, which was classified as critical, was found in code-projects Clothing Store Management System up to 1.0. Affected is the fu CVE-2025-406156.1Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim CVE-2025-406166.1Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim CVE-2025-406179.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendin CVE-2025-406189.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendin CVE-2025-406197.5Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor