Bank Locker Management System
Monthly
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale.
Session hijacking in PHPGurukul Bank Locker Management System v1.0 lets remote attackers reuse valid session tokens because the /banker/change-password.php component fails to invalidate existing sessions after a password change. Any session token captured before the change (via a shared machine, network capture, or referrer/log leakage) remains usable, letting an attacker impersonate the banker account. A GitHub reference (VasilVK/CVE) is published for this issue, and EPSS risk is low at 0.34% (27th percentile) with no active exploitation reported.
A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale.
Session hijacking in PHPGurukul Bank Locker Management System v1.0 lets remote attackers reuse valid session tokens because the /banker/change-password.php component fails to invalidate existing sessions after a password change. Any session token captured before the change (via a shared machine, network capture, or referrer/log leakage) remains usable, letting an attacker impersonate the banker account. A GitHub reference (VasilVK/CVE) is published for this issue, and EPSS risk is low at 0.34% (27th percentile) with no active exploitation reported.
A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.