CVE-2025-5913

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Vehicle Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchinputdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Vehicle Record Management System	1.0

References

https://github.com/kakalalaww/CVE/issues/3Exploit, Issue Tracking, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.311687Permissions Required, VDB Entry
https://vuldb.com/?id.311687Third Party Advisory, VDB Entry
https://vuldb.com/?submit.592310Third Party Advisory, VDB Entry
https://github.com/kakalalaww/CVE/issues/3Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-591304.3Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects App CVE-2025-591317.1Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2I CVE-2025-591324.3Cross-Site Request Forgery (CSRF) vulnerability in Badi Jones Duplicate Content Cure duplicate-content-cure allows Cross Site Request Forger CVE-2025-591337.5Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.CVE-2025-591348.8Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allo CVE-2025-591355.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager por CVE-2025-591365.3Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Emb CVE-2025-591377.1Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS CVE-2025-591384.9Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from CVE-2025-591395.3Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` CVE-2025-59147.8A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This fl CVE-2025-591408.8backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishin