CVE-2025-50484

HighCVSS 7.1

Published: 28/07/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

In PHPGurukul Small CRM v3.0, improper session invalidation in /crm/change-password.php allows attackers to perform a session hijacking attack.

Risk Assessment

An attacker can hijack an authenticated user's session, gaining unauthorized access to the CRM system and customer data.

Recommendation

Update PHPGurukul Small CRM to the latest version or apply a fix that forces session ID regeneration after password change.

Other vulnerabilities in PHPGurukul Small CRM

CVE-2026-90575Low
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.

Original NVD description (English source)

Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.