CVE-2025-12616: phpgurukul news_portal
Vulnerability summary
CVE-2025-12616 is a medium (CVSS 6.3) vulnerability in phpgurukul news_portal. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-11-2025PublishedVulnerability first disclosed.
- 24-02-2026Last modifiedVulnerability information updated.
Description
A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST2.9LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- NVDNIST2.6LowAV:N/AC:H/Au:N/C:P/I:N/A:N
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.05 pp
From 0.54% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNews Portal Python Django Project
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-215Insertion of Sensitive Information Into Debugging CodeThe product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Affected systems
Phpgurukul1 product
- news_portal1.0
1 vendor · 1 product
References
5 links- phpgurukul.comProduct