{"id":"CVE-2024-48282","aliases":["EUVD-2024-42981","GHSA-6rfh-8xcw-f6f2"],"status":"published","title":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration...","description":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration \u0026 Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00423,"percentile":0.36849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2024-10-15T00:00:00Z","modified":"2026-06-17T07:58:23Z","products":[{"vendor":"phpgurukul","product":"user_registration_\\\u0026_login_and_user_management_system"},{"vendor":"phpgurukul","product":"user_registration_and_login_and_user_management_system"}],"references":[{"url":"https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/SQL%20Injection%20-%20Forget%20Password.md","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48282"},{"url":"https://github.com/advisories/GHSA-6rfh-8xcw-f6f2"}],"sources":{"cve":[{"id":"CVE-2024-48282","description":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration \u0026 Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request.","status":"published","published":"2024-10-15T00:00:00Z","modified":"2024-10-15T15:01:57.067Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-42981","description":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration \u0026 Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request.","status":"published","published":"2024-10-15T00:00:00Z","modified":"2024-10-15T15:01:57Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:27:37.250145Z"}],"ghsa":[{"id":"GHSA-6rfh-8xcw-f6f2","title":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration...","description":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration \u0026 Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request.","status":"published","published":"2024-10-15T15:30:55Z","modified":"2024-10-15T18:31:56Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:58:30.303503Z"}],"nvd":[{"id":"CVE-2024-48282","description":"A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration \u0026 Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request.","status":"published","published":"2024-10-15T13:15:11.227Z","modified":"2026-06-17T07:58:23.263Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:31.879321Z"}]}}