CVE-2025-4813

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /edit-phlebotomist.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Human Metapneumovirus Testing Management System	1.0

References

https://github.com/Pjwww13447/pjwww/issues/6Exploit, Issue Tracking, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.309270Permissions Required, VDB Entry
https://vuldb.com/?id.309270Third Party Advisory, VDB Entry
https://vuldb.com/?submit.573888Third Party Advisory, VDB Entry

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-481307.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows CVE-2025-481316.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lit CVE-2025-481325.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addo CVE-2025-481339.8Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Contr CVE-2025-481347.2Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects W CVE-2025-481355.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-f CVE-2025-481368.8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Ca CVE-2025-481376.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in proxymis Interview interview allows SQ CVE-2025-481388.8Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Co CVE-2025-481396.5Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.Thi CVE-2025-48149.8A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an CVE-2025-481409.9Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.T