CVE-2025-4873

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	News Portal	4.1

References

https://github.com/Schatten-42/MyCVE/issues/6Exploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.309415Permissions Required
https://vuldb.com/?id.309415Third Party Advisory, VDB Entry
https://vuldb.com/?submit.576244Third Party Advisory, VDB Entry
https://github.com/Schatten-42/MyCVE/issues/6Exploit, Third Party Advisory

Timeline

Published: May 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-487306.5A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote a CVE-2025-487316.4Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a s CVE-2025-487329.8An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request CVE-2025-487337.5DuraComm SPM-500 DP-10iN-100-MU lacks access controls for a function that should require user authentication. This could allow an attacker CVE-2025-487348.8Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to CVE-2025-487354.3A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote at CVE-2025-487386.9An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 CVE-2025-487394.6A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and CVE-2025-48749.8A vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functiona CVE-2025-487405.9A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5 CVE-2025-487416.8A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote,CVE-2025-487429.8The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution.