CVE-2025-4361

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in PHPGurukul Company Visitor Management System 2.0. This affects an unknown part of the file /department.php. The manipulation of the argument departmentname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Company Visitor Management System	2.0

References

https://github.com/Pjwww13447/pjwww/issues/3Exploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.307485Permissions Required
https://vuldb.com/?id.307485Third Party Advisory, VDB Entry
https://vuldb.com/?submit.564750Third Party Advisory, VDB Entry

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-43629.8A vulnerability classified as critical was found in itsourcecode Gym Management System 1.0. This vulnerability affects unknown code of the f CVE-2025-43639.8A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. This issue affects some unknown CVE-2025-43648.7The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive fil CVE-2025-43657.5Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)CVE-2025-43666.1A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be inject CVE-2025-43675.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all CVE-2025-43689.8A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the f CVE-2025-43695.5The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘update_delay_days’ parameter in all ver CVE-2025-436977.5Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts Omn CVE-2025-436989.1Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for S CVE-2025-436995.3Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission chec CVE-2025-43705.3The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_u