CVE-2024-2265 is a medium severity sensitive information exposure in keerti1924 PHP-MYSQL-User-Login-System 1.0, scored 5.3 by NVD. The record lists no fixed release, so there is no confirmed patch to install. Restrict access to the affected component, correct the code if you own it, or retire the software.
Weakness: CWE-540 (Inclusion of Sensitive Information in Source Code).
What's affected
- Affected: keerti1924 PHP-MYSQL-User-Login-System, 1.0, as listed in the NVD record.
- Fixed: none named. The record names no fixed release for keerti1924 PHP-MYSQL-User-Login-System. Treat the software as unpatched until the vendor or the project says otherwise.
- Attack conditions: the CVSS vector is
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which means network reachable, no privileges needed, and the attack needs no user interaction.
The record says the flaw sits in the file login.sql. The vendor was contacted early about this disclosure but did not respond in any way, according to the record. The record also says the exploit has been disclosed to the public, which is why the exposure window matters whatever the score.
How to check if you're exposed
This is a standalone application, not a package on a registry, so there is no package manager command that reports it. Work through these steps instead.
- Search your hosting inventory, source repositories and deployment folders for the project name (keerti1924 PHP-MYSQL-User-Login-System).
- Open the installed copy and confirm whether it is version 1.0. If the version is not recorded, assume it is affected.
- Check whether the application is reachable from outside your network.
- Review web server access logs for unexpected requests to that path, and keep the logs you find.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Find every deployment of keerti1924 PHP-MYSQL-User-Login-System and decide whether it needs to be online at all. Many of these projects are tutorial or demo code.
- Look for a vendor or upstream update. The record names none, so check the project repository and the VulDB entry linked in the sources.
- Put the application behind authentication and a network allow list, or take it offline, until a fix exists.
- Remove login.sql and any database dumps from the web root, then rotate every password whose hash may have been exposed and force users to reset.
- Record the exception in your risk register with an owner and a review date.
Why it matters
Sensitive data inside a file that the web server will hand out is one of the simplest exposures to cause and one of the easiest to fix. Password hashes can be attacked offline, and weak or reused passwords fall quickly. Treat any exposed hash as a compromised credential.
The record classes this as CWE-540 (Inclusion of Sensitive Information in Source Code). NVD scored it 5.3 (Medium) with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The KEV flag in the record is false, so CISA's Known Exploited Vulnerabilities catalog does not list it, though the record notes public disclosure of the exploit. Small open source and sample style applications like this one often never get patched, so the control you have is exposure, not a version bump.
Quick check
Is there a patch for CVE-2024-2265?
The record lists no fixed version for keerti1924 PHP-MYSQL-User-Login-System. Check the project repository and the VulDB entry before assuming one exists, and plan around restricting access in the meantime.
Is this being exploited in the wild?
The record's KEV flag is false and no advisory we reviewed reports exploitation. The record does say the exploit details were published, so a copy of the technique is available to anyone.
Sources
- CVE-2024-2265 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2265, as held in the batch record
- VulDB entry for this CVE, linked from the record (see the Gold page for the reference list)
Last reviewed: 19 October 2026.
