This vulnerability allows an attacker to alter the current password parameter in the change-password.php script, bypassing authorization checks and enabling unauthorized password changes for any user account. The flaw arises because the system does not properly validate that the requester is the legitimate account holder or has appropriate administrative privileges before applying the new password. As a result, an adversary can impersonate another user or reset a password without authentication, leading to account takeover or denial of service.

PHPGurukul’s User Registration & Login and User Management System, version 3.3. The affected component is the Change Password Handler located in loginsystem/admin/change-password.php. Because the software is open source, the code is publicly available and users running this version are exposed.

The CVSS base score is 5.1, indicating a medium severity. No EPSS data is available, and the vulnerability has not been listed in the CISA KEV catalog. Attack vectors are remote; an attacker can send crafted requests to the vulnerable endpoint from any network location without requiring prior authentication. The public availability of the source code and the simple exploitation path mean that the risk to systems running this software is moderate but should be treated as actionable.