CVE-2025-10114: PHPGurukul Small CRM profile.php sql injection

Published Sep 9, 2025

Updated

A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

Affected Software

2 affected components

Phpgurukul Small CRM

Phpgurukul Small CRM=4.0

Event History

Sep 9, 2025

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10114?

CVE-2025-10114 is classified as a high severity vulnerability due to its potential for remote SQL injection attacks.

How do I fix CVE-2025-10114?

To mitigate CVE-2025-10114, update PHPGurukul Small CRM to the latest version or implement input validation and parameterized queries to prevent SQL injection.

What type of vulnerability is CVE-2025-10114?

CVE-2025-10114 is an SQL injection vulnerability that allows an attacker to manipulate database queries through the 'Name' parameter.

Which systems are affected by CVE-2025-10114?

CVE-2025-10114 affects PHPGurukul Small CRM version 4.0.

Can CVE-2025-10114 be exploited remotely?

Yes, CVE-2025-10114 can be exploited remotely, making it critical for affected systems to be promptly secured.