CVE-2025-6863

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/edit-category-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Local Services Search Engine Management System	2.1

References

https://github.com/louis-zly/myCVE/issues/1Exploit, Issue Tracking, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.314335Permissions Required, VDB Entry
https://vuldb.com/?id.314335Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603386Third Party Advisory, VDB Entry
https://github.com/louis-zly/myCVE/issues/1Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-686379.1The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configurat CVE-2025-68644.3A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functional CVE-2025-686405.3The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate d CVE-2025-686435.4Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. A CVE-2025-686447.4Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhan CVE-2025-686458.8A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper CVE-2025-686487.2A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7,CVE-2025-686496.5An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.CVE-2025-68654.3A vulnerability, which was classified as problematic, was found in DaiCuo up to 1.3.13. This affects an unknown part of the file /admin.php/CVE-2025-686566.8Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descripto CVE-2025-686576.4Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close(CVE-2025-686584.8Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos