CVE-2025-50487 describes a vulnerability in PHPGurukul Blood Bank & Donor Management System version 2.4 where the change-password.php component does not properly invalidate user sessions. This improper session invalidation (CWE-613) can enable attackers to hijack active sessions, potentially gaining unauthorized access. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to session hijacking, allowing attackers to access user accounts and sensitive data with the confidentiality impact rated as high. Integrity impact is low and availability is not affected. This compromises user session security and may lead to unauthorized actions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for vendor updates. Until a patch is available, consider implementing additional session management controls such as manual session invalidation after password changes and enforcing session timeouts.