CVE-2025-65647

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p16

Published

Nov 25, 2025 (Nov 25, 2025)

Modified

Jun 17, 2026

Description

Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter.

Vendors: phpgurukul
Products: online shopping portal
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.