CVE-2025-15406CWE-862CWE-863broken-access-control

CVE-2025-15406

Medium · published January 1, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-01-01T22:15Z
Affected products (1)
ProductVersionsFixed in
phpgurukul/online_course_registration≤ 3.1—
References (5)
https://github.com/rsecroot/Online-Course-Registration/blob/main/Broken%20Access%20Control.md · [email protected]https://phpgurukul.com/ · [email protected]https://vuldb.com/?ctiid.339326 · [email protected]https://vuldb.com/?id.339326 · [email protected]https://vuldb.com/?submit.728354 · [email protected]
EPSS history
Timeline
  • 01 JAN 17:02Z
    PHPGurukul Online Course Registration authorization
    cvelistv5