Is CVE-2025-50494 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-50494 being exploited in the wild.

How severe is CVE-2025-50494?

High severity, with a CVSS score of 7.5, published 28 July 2025.

Which products and versions are affected?

Phpgurukul Car Washing Management System 1.0.

Is there a fix for CVE-2025-50494?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-50494 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-50494?

Check whether you run Phpgurukul Car Washing Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-50494: PHPGurukul Car Washing Management System session hijacking in change-password.php

CVE-2025-50494 · Severity: high · CVSS 7.5 · Published 2025-07-28

A vulnerability exists in the PHPGurukul Car Washing Management System, a web application used to manage car wash operations. Due to a flaw in how the system handles user sessions during password changes, an attacker can hijack a user's active session. This could allow an unauthorized person to take over accounts, potentially leading to the theft of customer data or disruption of business operations.

Vendors: Phpgurukul.

Quick answers

Is CVE-2025-50494 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-50494 being exploited in the wild.
How severe is CVE-2025-50494?: High severity, with a CVSS score of 7.5, published 28 July 2025.
Which products and versions are affected?: Phpgurukul Car Washing Management System 1.0.
Is there a fix for CVE-2025-50494?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-50494 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-50494?: Check whether you run Phpgurukul Car Washing Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in the /admin/change-password.php component (also referenced as /doctor/change-password.php in some documentation) of PHPGurukul Car Washing Management System v1.0. The root cause is improper session invalidation and handling, which allows for session fixation or hijacking. An attacker can set or capture a session ID and, once a legitimate user authenticates, use that session to gain unauthorized remote access to the victim's account. This enables the attacker to perform administrative actions, such as changing the account password, without valid credentials.

Affected products

PHPGurukul Car Washing Management System 1.0

Timeline

2025-07-28: disclosed
2025-07-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.