Phpgurukul Small CRM vulnerabilities

20 CVEs affecting Phpgurukul Small CRM, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-90575, published 2026-09-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3690, published 2024-04-12. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in PHPGurukul Small CRM 3.0. Affected by this vulnerability is an unknown functionality of the component Change Password Handler. The manipulation…
CVE-2024-3691, published 2024-04-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in PHPGurukul Small CRM 3.0. Affected by this issue is some unknown functionality of the component Registration Page. The…
CVE-2024-13000, published 2024-12-29. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was found in PHPGurukul Small CRM 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/quote-details.php. The manipulation of the argument id…
CVE-2024-12999, published 2024-12-29. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been found in PHPGurukul Small CRM 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-user.php. The manipulation of the argument id…
CVE-2026-90575, published 2026-09-13. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument…
CVE-2025-5227, published 2025-05-27. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in PHPGurukul Small CRM 3.0 and classified as critical. This issue affects some unknown processing of the file /admin/manage-tickets.php. The manipulation of the argument…
CVE-2025-5226, published 2025-05-27. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-password.php. The manipulation of the argument…
CVE-2024-13001, published 2024-12-29. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in PHPGurukul Small CRM 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument email leads…
CVE-2025-11053, published 2025-09-27. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection.…
CVE-2025-10664, published 2025-09-18. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argument subject can lead to sql injection.…

Latest

CVE-2025-15390, published 2025-12-31. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible…
CVE-2024-44648, published 2025-11-17. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
CVE-2024-44647, published 2025-11-17. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php.
CVE-2024-44644, published 2025-11-17. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.
CVE-2024-44641, published 2025-11-17. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php.
CVE-2025-10114, published 2025-09-09. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection.…
CVE-2025-10079, published 2025-09-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulation of the argument Contact can lead to…