CVE-2025-4917

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function of the file /admin/new-autoortaxi-entry-form.php. The manipulation of the argument drivername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491756.1A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least o CVE-2025-491767.3A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, pote CVE-2025-491776.1A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client CVE-2025-491785.5A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processin CVE-2025-491797.3A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when comput CVE-2025-49189.8An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138 CVE-2025-491807.8A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to a CVE-2025-491818.6Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker CVE-2025-491829.8Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get f CVE-2025-491837.5All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. Thi CVE-2025-491847.5A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings o CVE-2025-491855.4The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious Ja