CVE-2025-11053: medium-severity vulnerability in PHPGurukul Small CRM
PHPGurukul Small CRM forgot-password.php sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
PHPGurukul · Small CRMRelated CVEs — PHPGurukul Small CRM
In the same product, most dangerous first.
CVE-2024-3690MEDIUMPHPGurukul Small CRM Change Password sql injectionEPSS 1.3%CVE-2024-3691HIGHPHPGurukul Small CRM Registration Page sql injectionEPSS 0.9%CVE-2024-13000MEDIUMPHPGurukul Small CRM quote-details.php sql injectionEPSS 0.5%CVE-2024-12999MEDIUMPHPGurukul Small CRM edit-user.php sql injectionEPSS 0.5%CVE-2025-5227MEDIUMPHPGurukul Small CRM manage-tickets.php sql injectionEPSS 0.5%CVE-2025-5226MEDIUMPHPGurukul Small CRM change-password.php sql injectionEPSS 0.5%