CVE-2025-4297

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/change-password.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Men Salon Management System	2.0

References

https://github.com/lierran1/CVE/issues/1Exploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.307401Permissions Required
https://vuldb.com/?id.307401Third Party Advisory, VDB Entry
https://vuldb.com/?submit.563548Third Party Advisory, VDB Entry

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-429705.8SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive CVE-2025-429714.0A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim ex CVE-2025-429735.4Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search func CVE-2025-429744.3Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This CVE-2025-429756.1SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC CVE-2025-429768.1SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Docum CVE-2025-429777.6SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a hi CVE-2025-429783.5The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hos CVE-2025-429795.6The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for sto CVE-2025-42989.8A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formS CVE-2025-429809.1SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content whic CVE-2025-429816.1Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding