CVE-2025-4916

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491626.4Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allo CVE-2025-491636.7Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.CVE-2025-491644.3Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f5 CVE-2025-49179.8A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function o CVE-2025-491756.1A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least o CVE-2025-491767.3A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, pote CVE-2025-491776.1A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client CVE-2025-491785.5A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processin CVE-2025-491797.3A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when comput CVE-2025-49189.8An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138 CVE-2025-491807.8A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to a CVE-2025-491818.6Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker