CVE-2025-11330

MediumCVSS 6.3

Published: 06/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

A SQL injection vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1 in the /admin/sales-reports-detail.php file. Manipulation of the fromdate/todate arguments allows remote exploitation. The exploit has been disclosed.

Risk Assessment

An attacker can manipulate SQL queries, potentially leading to unauthorized data access or corruption.

Recommendation

Apply parameterized SQL queries and update the system to a patched version.

Other vulnerabilities in PHPGurukul Beauty Parlour Management System

CVE-2024-53481Medium
A Cross Site Scripting (XSS) vulnerability was found in the profile.php of PHPGurukul Beauty Parlour Management System v1.1. Attackers can inject arbitrary HTML into the 'Firstname' and 'Last name' parameters, allowing remote code execution.

Original NVD description (English source)

A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports-detail.php. Such manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS