CVE-2025-4913

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Auto Taxi Stand Management System	1.0

References

https://github.com/Pjwww13447/pjwww/issues/15Exploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.309470Permissions Required
https://vuldb.com/?id.309470Third Party Advisory, VDB Entry
https://vuldb.com/?submit.579095Third Party Advisory, VDB Entry
https://github.com/Pjwww13447/pjwww/issues/15Exploit, Third Party Advisory

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491306.0Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross CVE-2025-491319.9FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational age CVE-2025-4913210.0Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale an CVE-2025-491335.5Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from CVE-2025-491345.3Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user CVE-2025-491356.5CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation dur CVE-2025-491366.5listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` CVE-2025-491376.1HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficient CVE-2025-491386.5HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusi CVE-2025-491396.5HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can c CVE-2025-49149.8A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been classified as critical. This affects an unknown p CVE-2025-491407.5Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet