CVE-2025-4736

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Daily Expense Tracker 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-473607.8Memory corruption while processing client message during device management.CVE-2025-473617.8Memory corruption when triggering a subsystem crash with an out-of-range identifier.CVE-2025-473626.1Information disclosure while processing message from client with invalid payload.CVE-2025-473637.8Memory corruption when calculating oversized partition sizes without proper checks.CVE-2025-473647.8Memory corruption while calculating offset from partition start point.CVE-2025-473657.8Memory corruption while processing large input data from a remote source via a communication interface.CVE-2025-473667.8Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.CVE-2025-473677.8Memory corruption while accessing a buffer during IOCTL processing.CVE-2025-473687.8Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing.CVE-2025-473695.5Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.CVE-2025-47376.2Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive informati CVE-2025-473706.5Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.