CVE-2025-4939

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in PHPGurukul Credit Card Application Management System 1.0. This vulnerability affects unknown code of the file /admin/new-ccapplication.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
PHPGurukul	Credit Card Application Management System	1.0

References

https://github.com/GIRISH05/credit-card-application-management-system-using-php-and-mysql/blob/main/Stored%20Cross-Site%20Scripting%20(XSS).mdExploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.309502Permissions Required, VDB Entry
https://vuldb.com/?id.309502Third Party Advisory, VDB Entry
https://vuldb.com/?submit.580119Third Party Advisory, VDB Entry
https://github.com/GIRISH05/credit-card-application-management-system-using-php-and-mysql/blob/main/Stored%20Cross-Site%20Scripting%20(XSS).mdExploit, Third Party Advisory

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-493907.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christophrado Cookie Notice & Consent CVE-2025-493914.3Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue CVE-2025-493925.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-a CVE-2025-493939.8Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Si CVE-2025-493947.1Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows CVE-2025-493956.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons themify-icons CVE-2025-493964.3Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Sec CVE-2025-493976.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbo CVE-2025-493986.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appo CVE-2025-493998.8Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Cross Site Request Forgery.This CVE-2025-49407.3A vulnerability, which was classified as critical, has been found in 1000 Projects Daily College Class Work Report Book 1.0. This issue affe CVE-2025-494009.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real