CVE-2025-12616
PHPGurukul News Portal settings.py insertion of sensitive information into debugging code
- State
- Published
- Severity
- 6.3 Medium
- Published
- Nov 3, 2025
- Updated
- Feb 24, 2026
- Reserved
- Nov 2, 2025
Description
A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.7 Low | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 2.6 Low | AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
News PortalPHPGurukul |
|
References
- VDB-330910 | PHPGurukul News Portal settings.py insertion of sensitive information into debugging codevdb-entrytechnical-description
- VDB-330910 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #678649 | PHPGurukul News Portal using Python Django and MySQL 1.0 Insertion of Sensitive Information Into Debugging Codethird-party-advisory
- https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%20Mode.mdexploit
- https://phpgurukul.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.