CVE-2025-28011

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System version 3.3

Description: A SQL Injection issue was discovered in the loginsystem/change-password.php file, allowing remote attackers to execute arbitrary code via the currentpassword POST request parameter.

Recommendations: For PHPGurukul User Registration & Login and User Management System version 3.3, consider restricting access to the loginsystem/change-password.php file until a patch is available. As a temporary workaround, avoid using the currentpassword parameter in the affected POST request until the issue is resolved.