Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2025-11053: PHPGurukul Small CRM 4.0: Malicious Email Attacks Possible
CVE-2025-11053 · published 1 year ago
Summary
A security weakness in PHPGurukul Small CRM 4.0 makes it possible for hackers to inject malicious code into the system using manipulated email addresses. This could allow them to access or compromise sensitive data. It's recommended that users update to the latest version of the software to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| phpgurukul | small_crm |
4.0 cpe:2.3:a:phpgurukul:small_crm:4.0:*:*:*:*:*:*:* |
Original advisory text
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection...
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
References
- https://github.com/underatted/CVE/issues/2 Exploit Issue Tracking Third Party Advisory
- https://phpgurukul.com/ Product
- https://vuldb.com/?ctiid.326093 Permissions Required VDB Entry
- https://vuldb.com/?id.326093 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.659439 Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
5.5
Medium
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published27 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-11053 · NVD
Track software like this
Free during beta