CVE-2025-12615: phpgurukul news_portal Key Management Errors

Vulnerability summary

CVE-2025-12615 is a high (CVSS 8.1) Key Management Errors vulnerability in phpgurukul news_portal. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-11-2025
   PublishedVulnerability first disclosed.
2. 24-02-2026
   Last modifiedVulnerability information updated.

Description

A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.

• CWE-320Key Management ErrorsWeaknesses in this category are related to errors in the management of cryptographic keys.
• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.