CVE-2025-70899

MEDIUM EPSS 4.1%

Published Jan 22, 20265mo ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published Jan 22, 2026 5mo ago

Last Modified Jun 17, 2026 2w ago

Description

PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage.

CVSS Details

Base Score

6.5

Exploitability

2.8

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

4.1% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 1

Vendor	Product	Version	Range
phpgurukul	online_course_registration	3.1	any

References 2

github.com https://github.com/mathavamoorthi/CVE-2025-70899/blob/main/Missing_CSRF_protection_poc.md

ExploitMitigationThird Party Advisory
phpgurukul.com https://phpgurukul.com/online-course-registration-free-download/

Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.