CVE-2025-5210

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects unknown code of the file /loginerms.php. The manipulation of the argument Email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Employee Record Management System	1.3

References

https://github.com/ting-06a/myCVE/issues/1Exploit, Issue Tracking
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.310306Permissions Required, VDB Entry
https://vuldb.com/?id.310306Third Party Advisory, VDB Entry
https://vuldb.com/?submit.582802Third Party Advisory, VDB Entry

Timeline

Published: May 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-521019.8linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the au CVE-2025-52119.8A vulnerability was found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This issue affects some unknown pr CVE-2025-52129.8A vulnerability was found in PHPGurukul Employee Record Management System 1.3. It has been classified as critical. Affected is an unknown fu CVE-2025-521229.8Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbit CVE-2025-52139.8A vulnerability was found in projectworlds Responsive E-Learning System 1.0. It has been declared as critical. Affected by this vulnerabilit CVE-2025-521305.4File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticate CVE-2025-521316.4The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.CVE-2025-521326.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.CVE-2025-521336.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.CVE-2025-521363.0In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is t CVE-2025-52149.8A vulnerability was found in Kashipara Responsive Online Learing Platform 1.0. It has been rated as critical. Affected by this issue is some CVE-2025-52159.8A vulnerability classified as critical has been found in D-Link DCS-5020L 1.01_B2. This affects the function websReadEvent of the file /rame