5
CVEs
0
Critical
0
High
0
KEV
5
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
2
LOW
3
Monthly CVE Trend
Affected Products (30)
PHP
944
Hospital Management System
41
Zoo Management System
36
Art Gallery Management System
36
Complaint Management System
32
Online Fire Reporting System
32
Online Shopping Portal
32
Student Record System
29
Beauty Parlour Management System
28
User Registration Login And User Management System
25
Land Record System
25
Pre School Enrollment System
24
Vehicle Parking Management System
24
Dairy Farm Shop Management System
23
Old Age Home Management System
21
Nipah Virus Testing Management System
20
Apartment Visitors Management System
20
Park Ticketing Management System
20
Small Crm
19
Cyber Cafe Management System
19
Covid19 Testing Management System
19
Boat Booking System
18
Bank Locker Management System
18
Restaurant Table Booking System
17
Directory Management System
17
Emergency Ambulance Hiring Portal
17
Online Nurse Hiring System
17
Men Salon Management System
17
Employee Record Management System
16
Rail Pass Management System
15
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-90517 | Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75089 | SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-90519 | Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-82424 | SQL injection in PHPGurukul Student Information System 1.0 exposes the `/student_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter. Remote attackers with low-privilege application credentials can read, alter, or partially disrupt data stored in the backend database. A public proof-of-concept is available on GitHub, lowering the technical barrier for opportunistic exploitation against internet-facing deployments. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-19207 | Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the `fullname` parameter in `/manage-newvisitors.php`, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV. | LOW | 1.9 | 0.2% | 30 |
PoC
No patch
|