CVE-2025-28011

Summary

CVE-2025-28011 is a SQL injection vulnerability affecting the PHPGurukul User Registration & Login and User Management System version 3.3. The issue lies in the loginsystem/change-password.php file, where an attacker can exploit the currentpassword POST request parameter to inject malicious SQL commands. This allows the attacker to execute arbitrary code remotely, potentially gaining unauthorized access to sensitive data or even taking control of the entire system. Users are advised to upgrade to a patched version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.