CVE-2025-40690

CriticalCVSS 9.8

Published: 11/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

SQL injection vulnerability in Online Fire Reporting System v1.2 by PHPGurukul. It allows an attacker to retrieve, create, update, and delete databases via the 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.

Risk Assessment

An attacker can manipulate the system's database, potentially leading to confidentiality, integrity, and availability breaches.

Recommendation

Apply patches or restrict access to the vulnerable endpoint, and use parameterized queries.

Other vulnerabilities in Online Fire Reporting System

CVE-2022-34611Medium
A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.

Original NVD description (English source)

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS