CVE-2025-50485
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The vulnerability in the /crm/change-password.php script of PHPGurukul Online Course Registration v3.1 stems from improper session invalidation after password change. This allows an attacker to hijack the user's session and gain unauthorized access to the account.
Risk Assessment
An attacker can hijack a logged-in user's session, leading to data theft, unauthorized actions within the system, and compromise of account confidentiality and integrity.
Recommendation
Update the system to the latest version or manually modify the /crm/change-password.php script to invalidate the old session after password change and force re-authentication.
Other vulnerabilities in PHPGurukul Online Course Registration
See all- CVE-2026-5814High
A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1 in the file /admin/check_availability.php. Manipulation of the regno argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-5813High
PHPGurukul Online Course Registration 3.1 has a SQL injection vulnerability in /check_availability.php via the cid argument. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.