CVE-2025-51414 Details
Description
In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.
A vulnerability allowing arbitrary file upload has been identified in Phpgurukul Online Course Registration version 3.1. This issue arises within the profile picture upload feature on the '/my-profile.php' page. The application fails to properly validate or filter uploaded files, enabling authenticated users to upload malicious PHP scripts that can be executed on the server. This flaw could lead to remote code execution, allowing attackers to execute arbitrary commands on the server by accessing the uploaded files.
Users are advised to implement strict server-side validation of uploaded files, allowing only specific file types such as images. Additionally, uploaded files should be stored outside the web root, execution of scripts in upload directories should be disabled, and files should be renamed to prevent direct access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 13, 2026CISA-ADP
Assessed Apr 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/12T40910/CVE/issues/12 | [email protected] | ExploitTechnical Description |
| https://medium.com/@tanushkushtk01/cve-2025-51414-unrestricted-file-upload-in-online-course-registration-v3-1-bd8b839be1d7 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Phpgurukul Online Course Registration | 3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | [email protected] |