Is phpgurukul/online_shopping_portal safe ? phpgurukul/online_shopping_portal (packagist) has 11 known vulnerabilities, the worst rated CRITICAL. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 39th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — CVE-2024-44659, the advisory selected below
// 11 advisories CVE CVE-2024-44659 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. CRIT CVE CVE-2025-57148 phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation. CRIT CVE CVE-2023-38890 Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and… HIGH CVE CVE-2025-65647 Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid… MEDI CVE CVE-2024-44664 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php. MEDI CVE CVE-2024-44661 PHPGurukul Online Shopping Portal 2.0 is vulnerable to Cross Site Scripting (XSS) via the quantity parameter in my-cart.php. MEDI CVE CVE-2024-44663 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php. MEDI CVE CVE-2024-44660 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php. MEDI CVE CVE-2024-44662 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. MEDI CVE CVE-2025-52074 PHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameter when adding a… MEDI CVE CVE-2025-57576 PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php. MEDI PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php.
Full advisory text at NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High // questions Is phpgurukul/online_shopping_portal safe to install? CyberXYZ does not call a package safe in absolute terms. It records 11 known vulnerabilities for phpgurukul/online_shopping_portal (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does phpgurukul/online_shopping_portal have known vulnerabilities? Yes. CyberXYZ records 11 known vulnerabilities for phpgurukul/online_shopping_portal (packagist), the worst rated CRITICAL. These include CVE-2024-44659, CVE-2025-57148, CVE-2023-38890, CVE-2025-65647, CVE-2024-44664.
How do I check phpgurukul/online_shopping_portal before installing? Search phpgurukul/online_shopping_portal in CyberXYZ Check at https://cyberxyz.io/check?q=phpgurukul%2Fonline_shopping_portal . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 15:14 UTC. The most recent advisory here was published 2025-11-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page