CVE-2025-50484: phpgurukul small_crm Insufficient Session Expiration

Vulnerability summary

CVE-2025-50484 is a high (CVSS 7.1) Insufficient Session Expiration vulnerability in phpgurukul small_crm. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-07-2025
   PublishedVulnerability first disclosed.
2. 05-07-2026
   Last modifiedVulnerability information updated.

Description

Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."