CVE-2024-44654
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.
Risk Assessment
An attacker could manipulate the password reset process or extract user data, potentially leading to account takeover.
Recommendation
Update the application to a fixed version or implement query parameterization and validation for the email and mobileno parameters in reset-password.php.
Other vulnerabilities in PHPGurukul Complaint Management System
See all- CVE-2026-75089High
A weakness has been identified in PHPGurukul Complaint Management System 1.0, affecting the file user/check_availability.php. Manipulation of the argument email causes SQL injection. Remote exploitation is possible and the exploit has been made public.
- CVE-2024-46335Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php. Input is not properly sanitized.
- CVE-2024-44658Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.
- CVE-2024-44655Medium
PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php. Improperly sanitized input allows injection of malicious script.
Original NVD description (English source)
PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS