What’s Vulnerable › Vulnerabilities

CVE-2025-40689: SQL injection in PHPGurukul Online Fire Reporting System

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-11 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via  'remark', 'status' and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'.

Affected products

• PHPGurukul Online Fire Reporting System: 1.2

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system

Get alerted when CVE-2025-40689 or the next vulnerability affects your stack