CVE-2025-5670

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /admin/manage-card.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Medical Card Generation System	1.0

References

https://github.com/f1rstb100d/myCVE/issues/52Exploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.311159Permissions Required
https://vuldb.com/?id.311159Third Party Advisory, VDB Entry
https://vuldb.com/?submit.590066Third Party Advisory, VDB Entry
https://github.com/f1rstb100d/myCVE/issues/52Exploit, Third Party Advisory

Timeline

Published: Jun 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-567005.4Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level privi CVE-2025-567048.8LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files CVE-2025-567068.0Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getCo CVE-2025-56718.8A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function o CVE-2025-567107.3A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Usin CVE-2025-56728.8A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an CVE-2025-56736.5The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter CVE-2025-56748.8A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some u CVE-2025-567462.2Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation CVE-2025-567476.5Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regul CVE-2025-567486.4Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limi CVE-2025-567499.4Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows atta