https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-70899.htmlhttps://patchthecve.com/cve/CVE-2025-70899.htmlWed, 17 Jun 2026 10:03:27 +0000MEDIUM 6.5: PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage.https://patchthecve.com/cve/CVE-2026-0547.htmlhttps://patchthecve.com/cve/CVE-2026-0547.htmlWed, 17 Jun 2026 10:10:55 +0000MEDIUM 6.3: A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in unrestricted upload. The attack may be lahttps://patchthecve.com/cve/CVE-2025-15406.htmlhttps://patchthecve.com/cve/CVE-2025-15406.htmlWed, 07 Oct 2026 11:10:00 +0000MEDIUM 6.3: A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used.https://patchthecve.com/cve/CVE-2025-10663.htmlhttps://patchthecve.com/cve/CVE-2025-10663.htmlWed, 17 Jun 2026 08:28:43 +0000HIGH 7.3: A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.https://patchthecve.com/cve/CVE-2025-10025.htmlhttps://patchthecve.com/cve/CVE-2025-10025.htmlWed, 17 Jun 2026 08:27:32 +0000HIGH 7.3: A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.php. The manipulation of the argument semester leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publichttps://patchthecve.com/cve/CVE-2025-9729.htmlhttps://patchthecve.com/cve/CVE-2025-9729.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.3: A vulnerability was detected in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /admin/student-registration.php. Performing manipulation of the argument studentname results in sql injection. The attack is possible to be carried out remotely. The exploithttps://patchthecve.com/cve/CVE-2025-9307.htmlhttps://patchthecve.com/cve/CVE-2025-9307.htmlWed, 17 Jun 2026 10:08:43 +0000HIGH 7.3: A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This manipulation of the argument sesssion causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.https://patchthecve.com/cve/CVE-2025-50485.htmlhttps://patchthecve.com/cve/CVE-2025-50485.htmlSun, 05 Jul 2026 16:19:31 +0000HIGH 7.1: Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.https://patchthecve.com/cve/CVE-2025-4794.htmlhttps://patchthecve.com/cve/CVE-2025-4794.htmlWed, 17 Jun 2026 09:34:01 +0000HIGH 7.3: A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /news.php. The manipulation of the argument newstitle leads to sql injection. The attack can be launched remotely. The explhttps://patchthecve.com/cve/CVE-2025-4793.htmlhttps://patchthecve.com/cve/CVE-2025-4793.htmlWed, 17 Jun 2026 09:34:01 +0000HIGH 7.3: A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been classified as critical. Affected is an unknown function of the file /edit-student-profile.php. The manipulation of the argument cgpa leads to sql injection. It is possible to launch the attack remotely. The exploit hhttps://patchthecve.com/cve/CVE-2025-4773.htmlhttps://patchthecve.com/cve/CVE-2025-4773.htmlWed, 17 Jun 2026 09:33:59 +0000HIGH 7.3: A vulnerability was found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/level.php. The manipulation of the argument level leads to sql injection. The attack may be launched remotely. The exploit has behttps://patchthecve.com/cve/CVE-2025-4772.htmlhttps://patchthecve.com/cve/CVE-2025-4772.htmlWed, 17 Jun 2026 09:33:58 +0000HIGH 7.3: A vulnerability has been found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/department.php. The manipulation of the argument department leads to sql injection. The attack can be launched remotelhttps://patchthecve.com/cve/CVE-2025-4771.htmlhttps://patchthecve.com/cve/CVE-2025-4771.htmlWed, 17 Jun 2026 09:33:58 +0000HIGH 7.3: A vulnerability, which was classified as critical, was found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/course.php. The manipulation of the argument coursecode leads to sql injection. It is possible to launch the attack remotely. The exploit has https://patchthecve.com/cve/CVE-2020-36064.htmlhttps://patchthecve.com/cve/CVE-2020-36064.htmlWed, 17 Jun 2026 03:14:45 +0000CRITICAL 9.8: Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.https://patchthecve.com/cve/CVE-2020-23828.htmlhttps://patchthecve.com/cve/CVE-2020-23828.htmlWed, 17 Jun 2026 03:04:59 +0000CRITICAL 9.8: A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE) on the hosting webserver by uploading a crafted PHP web-shell that bypasses the image upload filters. An attack uses /Online%20Course%20Registration/my-profile