CVE

CVE-2025-2473

6.9

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

company visitor management system

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalWeb Vulnerabilities~10 seconds

Company Visitor Management System 1.0 - SQL Injection

Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. References: https://www.exploit-db.com/exploits/48884 https://packetstormsecurity.com/files/158476/Company-Visitor-Management-System-CVMS-1.0-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2025-2473

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: company visitor management system

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →