Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-61096: PHPGurukul Shopping Portal login page exposed to malicious database attacks

CVE-2025-61096 · published 1 year ago

Summary

The login page of the PHPGurukul Shopping Portal is vulnerable to a specific type of cyber attack that could allow hackers to access sensitive information. This means that if a malicious person knows how to exploit this weakness, they could potentially gain unauthorized access to the database. To protect the portal, the developer should update the /shopping/login.php file to prevent this type of attack.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
phpgurukul	online_shopping_portal_project	2.1 `cpe:2.3:a:phpgurukul:online_shopping_portal_project:2.1:::::::*`

Original advisory text

PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter.

References

https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-2025-61096 Exploit Third Party Advisory
https://www.linkedin.com/in/shuvo-ahmed-sanin/ Not Applicable

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published2 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-61096 · NVD

Track software like this

Free during beta