CVE-2025-12616
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability was detected in PHPGurukul News Portal 1.0 affecting an unknown function in /onps/settings.py. Manipulation results in insertion of sensitive information into debugging code. The attack can be initiated remotely, but its complexity is rated as high and exploitability as difficult. The exploit is now public and may be used.
Risk Assessment
An attacker could remotely exploit the vulnerability to expose sensitive information in debugging code, potentially leading to data leakage. The high complexity of the attack limits the risk.
Recommendation
Update the application to a version where the issue is fixed or apply vendor-provided patches. Until then, disable debugging mode and monitor access to settings.py.
Other vulnerabilities in PHPGurukul News Portal
See all- CVE-2026-5837High
PHPGurukul News Portal Project 4.1 has a SQL injection vulnerability in /news-details.php via the Comment argument. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-12615Medium
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS