https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-5368.htmlhttps://patchthecve.com/cve/CVE-2025-5368.htmlWed, 17 Jun 2026 09:47:46 +0000MEDIUM 6.3: A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. This issue affects some unknown processing of the file /expense-yearwise-reports-detailed.php. The manipulation of the argument todate leads to sql injection. The attack may be initiated remotelyhttps://patchthecve.com/cve/CVE-2025-4925.htmlhttps://patchthecve.com/cve/CVE-2025-4925.htmlWed, 17 Jun 2026 09:34:19 +0000HIGH 7.3: A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /expense-monthwise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. The attachttps://patchthecve.com/cve/CVE-2025-4908.htmlhttps://patchthecve.com/cve/CVE-2025-4908.htmlWed, 17 Jun 2026 09:34:17 +0000HIGH 7.3: A vulnerability classified as critical has been found in PHPGurukul Daily Expense Tracker System 1.1. This affects an unknown part of the file /expense-datewise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotehttps://patchthecve.com/cve/CVE-2025-4907.htmlhttps://patchthecve.com/cve/CVE-2025-4907.htmlWed, 17 Jun 2026 09:34:17 +0000HIGH 7.3: A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The explhttps://patchthecve.com/cve/CVE-2025-4785.htmlhttps://patchthecve.com/cve/CVE-2025-4785.htmlWed, 17 Jun 2026 09:34:00 +0000HIGH 7.3: A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user-profile.php. The manipulation of the argument fullname/contactnumber leads to sql injection. The attack may be launched remohttps://patchthecve.com/cve/CVE-2025-25351.htmlhttps://patchthecve.com/cve/CVE-2025-25351.htmlWed, 17 Jun 2026 09:00:41 +0000CRITICAL 9.8: PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter.https://patchthecve.com/cve/CVE-2025-25349.htmlhttps://patchthecve.com/cve/CVE-2025-25349.htmlWed, 17 Jun 2026 09:00:41 +0000CRITICAL 9.8: PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter.