CVE-2025-6910

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. The manipulation of the argument session leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-691008.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North no CVE-2025-691019.8Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse CVE-2025-691027.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-e CVE-2025-691037.5Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.CVE-2025-691047.1Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.CVE-2025-691058.1Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.CVE-2025-691068.1Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.CVE-2025-691078.1Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.CVE-2025-691089.8Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.CVE-2025-691098.1Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.CVE-2025-69118.8A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code CVE-2025-691108.1Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.