Is CVE-2025-50492 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-50492 being exploited in the wild.

How severe is CVE-2025-50492?

High severity, with a CVSS score of 7.5, published 28 July 2025.

Which products and versions are affected?

Phpgurukul E-Diary Management System 1.0.

Is there a fix for CVE-2025-50492?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-50492 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-50492?

Check whether you run Phpgurukul E-Diary Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-50492: PHPGurukul e-Diary Management System improper session invalidation

CVE-2025-50492 · Severity: high · CVSS 7.5 · Published 2025-07-28

A vulnerability exists in the PHPGurukul e-Diary Management System, a web application used for managing personal or business diaries. The software fails to properly invalidate user sessions when a password is changed. This could allow an unauthorized person to maintain access to an account even after the legitimate owner attempts to secure it, potentially leading to the theft of private diary entries or unauthorized account control.

Vendors: Phpgurukul.

Quick answers

Is CVE-2025-50492 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-50492 being exploited in the wild.
How severe is CVE-2025-50492?: High severity, with a CVSS score of 7.5, published 28 July 2025.
Which products and versions are affected?: Phpgurukul E-Diary Management System 1.0.
Is there a fix for CVE-2025-50492?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-50492 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-50492?: Check whether you run Phpgurukul E-Diary Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A session management vulnerability exists in PHPGurukul e-Diary Management System v1.0 within the '/edms/change-password.php' component. The application fails to terminate or invalidate existing active sessions upon a password change event. An attacker who has previously obtained a valid session identifier can continue to access the application even after the user updates their credentials. This flaw is categorized as improper session invalidation (related to CWE-20) and can be exploited over the network without specific user interaction, leading to persistent unauthorized access.

Affected products

PHPGurukul e-Diary Management System 1.0

Timeline

2025-07-28: advisory: Initial disclosure by NVD/MITRE

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.