CVE-2025-45949: Phpgurukul User Registration & Login And User Management System

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover.

Affected products

• Phpgurukul User Registration & Login And User Management System: version 3.3 only

Published 2025-04-28. Last modified 2026-07-05.