CVE-2025-69992
CriticalSummary
phpgurukul News Portal Project V4.1 has a File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
Risk Assessment
The vulnerability allows an unauthenticated attacker to upload malicious files, potentially leading to remote code execution, server compromise, or website defacement.
Recommendation
Update News Portal Project to a patched version or implement custom security measures such as file type validation and authentication requirements for uploads.
Other vulnerabilities in phpgurukul News Portal Project
See all- CVE-2025-69991Critical
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
- CVE-2025-69990Critical
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
- CVE-2026-5840Medium
A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- CVE-2026-5839Medium
A SQL injection vulnerability was identified in PHPGurukul News Portal Project 4.1 within the file /admin/add-subcategory.php. Manipulation of the sucatdescription argument allows SQL code injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-5838Medium
A SQL injection vulnerability was determined in PHPGurukul News Portal Project 4.1 affecting the file /admin/add-subadmins.php. Manipulation of the sadminusername argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS