CVE-2025-6415

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.1. This issue affects some unknown processing of the file /admin/changeimage3.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Art Gallery Management System	1.1

References

https://github.com/f1rstb100d/myCVE/issues/88Exploit, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.313409Permissions Required
https://vuldb.com/?id.313409Third Party Advisory, VDB Entry
https://vuldb.com/?submit.598231Third Party Advisory, VDB Entry
https://github.com/f1rstb100d/myCVE/issues/88Exploit, Third Party Advisory

Timeline

Published: Jun 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-641505.4A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect t CVE-2025-641518.4Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write CVE-2025-641529.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoT CVE-2025-641537.2A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, CVE-2025-641559.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, For CVE-2025-641567.2An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7 CVE-2025-641577.2A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 CVE-2025-64168.8A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown functio CVE-2025-641639.8DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// a CVE-2025-641649.8Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishi CVE-2025-641665.4Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The i CVE-2025-641676.1Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (