CVE-2025-50484
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In PHPGurukul Small CRM v3.0, improper session invalidation in /crm/change-password.php allows attackers to perform a session hijacking attack.
Risk Assessment
An attacker can hijack an authenticated user's session, gaining unauthorized access to the CRM system and customer data.
Recommendation
Update PHPGurukul Small CRM to the latest version or apply a fix that forces session ID regeneration after password change.
Other vulnerabilities in PHPGurukul Small CRM
See all- CVE-2026-90575Low
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.
- CVE-2024-44648Medium
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. An attacker can exploit this flaw to manipulate SQL queries.
- CVE-2024-44647Medium
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS