PHPGurukul Student Record System version 3.20 contains an SQL Injection vulnerability in the password-recovery.php script via the id and emailid parameters. This flaw allows an unauthenticated attacker to inject malicious SQL code, potentially leading to unauthorized access or data leakage. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No known exploits are reported in the wild, and no official patch or remediation guidance is currently available.