28
CVEs
0
Critical
0
High
0
KEV
27
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
8
LOW
20
Monthly CVE Trend
Affected Products (30)
PHP
949
Hospital Management System
41
Zoo Management System
36
Art Gallery Management System
36
Complaint Management System
32
Online Shopping Portal
32
Online Fire Reporting System
32
Student Record System
29
Beauty Parlour Management System
28
User Registration Login And User Management System
25
Land Record System
25
Vehicle Parking Management System
24
Pre School Enrollment System
24
Dairy Farm Shop Management System
23
Old Age Home Management System
21
Nipah Virus Testing Management System
20
Apartment Visitors Management System
20
Park Ticketing Management System
20
Cyber Cafe Management System
19
Covid19 Testing Management System
19
Small Crm
19
Boat Booking System
18
Bank Locker Management System
18
Men Salon Management System
17
Restaurant Table Booking System
17
Directory Management System
17
Emergency Ambulance Hiring Portal
17
Online Nurse Hiring System
17
Employee Record Management System
16
Hostel Management System
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-90517 | Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75089 | SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-90844 | SQL injection in PHPGurukul Daily Expense Tracker System 1.1 allows unauthenticated remote attackers to manipulate the email parameter in the pre-authentication login form at /dets/index.php, enabling authentication bypass or database content extraction. A public exploit is available on GitHub, removing any meaningful skill barrier to exploitation. No vendor-released patch has been identified; the CVSS 4.0 score of 5.5 with all impacts rated Low reflects the application's narrow data scope rather than a general downgrade of the SQL injection risk class. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-90846 | SQL injection in PHPGurukul Daily Expense Tracker System 1.1 exposes the unauthenticated forgot-password endpoint `/dets/forgot-password.php`, where the `email` and `contactno` parameters are passed unsanitized to backend SQL queries. Any remote, unauthenticated attacker can exploit this to read or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation; no KEV listing exists at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-5814 | SQL injection in PHPGurukul Online Course Registration 3.1 allows remote unauthenticated attackers to manipulate the regno parameter in /admin/check_availability.php, enabling arbitrary database queries with potential for data exfiltration and modification. The vulnerability has a publicly available exploit and CVSS 6.9 score indicating moderate severity with confirmed data confidentiality and integrity impact. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-5837 | SQL injection in PHPGurukul News Portal Project 4.1 allows unauthenticated remote attackers to extract, modify, or delete database contents through the Comment parameter in /news-details.php. CVSS 7.3 severity with network-accessible attack vector requiring no authentication or user interaction. Publicly available exploit code exists. Attackers can compromise confidentiality, integrity, and availability of application data through crafted SQL payloads in comment submission functionality. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-6193 | SQL injection in PHPGurukul Daily Expense Tracking System 1.1 exposes the unauthenticated `/register.php` registration endpoint to remote database manipulation via a crafted `email` parameter. A proof-of-concept exploit has been publicly released on GitHub, and SSVC assessment confirms the attack is automatable with no prerequisites beyond network access to the application. No public exploitation at scale has been confirmed (not in CISA KEV) and EPSS remains at 0.03%, though the unauthenticated attack surface combined with available exploit code represents a concrete risk for any internet-facing deployment. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-90519 | Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-90851 | Improper access control in PHPGurukul Hostel Management System 3.0 allows an attacker to bypass authorization checks in the admin login handler /admin/includes/checklogin.php by manipulating the ID parameter, granting unauthorized access to administrative functionality. Exploitation is remotely reachable and publicly available exploit code exists (tracked via a GitHub PoC issue and VulDB entry), though the per-component impact is limited to low confidentiality, integrity and availability loss. EPSS/KEV signals are absent from the provided data, and the published CVSS 4.0 base metrics (AV:N/AC:L/PR:L/UI:N, all impacts Low) indicate a modest real-world risk rather than mass-exploitation potential. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-82424 | SQL injection in PHPGurukul Student Information System 1.0 exposes the `/student_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter. Remote attackers with low-privilege application credentials can read, alter, or partially disrupt data stored in the backend database. A public proof-of-concept is available on GitHub, lowering the technical barrier for opportunistic exploitation against internet-facing deployments. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-5543 | SQL injection in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/yesterday-reg-users.php, potentially leading to unauthorized data access, modification, or deletion. Publicly available exploit code exists; CVSS 6.3 reflects moderate impact with low attack complexity and authenticated access requirement. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-5558 | SQL injection in PHPGurukul Online Shopping Portal Project up to version 2.1 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /pending-orders.php, potentially leading to unauthorized data access or modification. The vulnerability has a published proof-of-concept exploit available and carries a CVSS score of 5.3 with moderate real-world impact due to authentication requirements. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-5560 | SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to manipulate the paymethod parameter in /payment-method.php, enabling database query execution with limited confidentiality, integrity, and availability impact. The vulnerability is publicly documented with exploit code available, presenting moderate real-world risk despite the CVSS 6.3 score, as exploitation requires valid authentication credentials. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-5640 | SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL queries via the filename parameter in /admin/update-image2.php. The vulnerability affects the parameter handling mechanism and has publicly available exploit code; attackers with administrative credentials can manipulate the filename argument to inject SQL commands, potentially leading to data exfiltration or modification with limited direct impact to confidentiality and integrity of the application layer. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-5641 | SQL injection in PHPGurukul Online Shopping Portal Project 2.1 allows authenticated remote attackers to execute arbitrary SQL queries via the filename parameter in /admin/update-image1.php, potentially compromising data confidentiality, integrity, and availability. Publicly available exploit code exists, elevating real-world risk despite the moderate CVSS score. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|