The vulnerability CVE-2025-50484 affects PHPGurukul Small CRM version 3.0. It arises from improper session invalidation in the /crm/change-password.php component, which can be exploited by attackers to hijack user sessions. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requiring user interaction, and impacts confidentiality with high severity. There is no information on available patches or fixes at this time.

Successful exploitation of this vulnerability allows an attacker to hijack user sessions, potentially gaining unauthorized access to sensitive information or user accounts within the CRM system. The confidentiality impact is high, while integrity impact is low and availability is unaffected. This could lead to unauthorized data exposure or actions performed under the hijacked session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional session management controls such as manual session invalidation after password changes and monitoring for suspicious session activity. Avoid relying solely on the vulnerable component for session security.