CVE-2025-12615
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
Risk Assessment
An attacker could exploit the hard-coded key to break cryptographic protections, potentially leading to unauthorized data access.
Recommendation
Remove the hard-coded key and replace it with a secure key management mechanism, then update the application.
Other vulnerabilities in PHPGurukul News Portal
See all- CVE-2026-5837High
PHPGurukul News Portal Project 4.1 has a SQL injection vulnerability in /news-details.php via the Comment argument. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-12616Low
A vulnerability was detected in PHPGurukul News Portal 1.0 affecting an unknown function in /onps/settings.py. Manipulation results in insertion of sensitive information into debugging code. The attack can be initiated remotely, but its complexity is rated as high and exploitability as difficult. The exploit is now public and may be used.
Original NVD description (English source)
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS