phpgurukul has 24 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 12 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 12. The median CVSS is 6.3 (medium), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-89 (9) and CWE-79 (8). Most affected products: Bank Locker Management System (3), Blood Donor Management System (3), Daily Expense Tracker System (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 12 prev 0
Products
- Bank Locker Management System 3
- Blood Donor Management System 3
- Daily Expense Tracker System 3
- directory_management_system 3
- zoo_management_system 3
- Hostel Management System 2
Worst active — by depth score
CVE-2022-35156Critical· 9.8Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..54CVE-2022-31384Critical· 9.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.54CVE-2022-31383Critical· 9.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.54CVE-2022-31382Critical· 9.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.54CVE-2026-90846High· 7.3A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.152
phpgurukul vulnerabilities
CVEs affecting phpgurukul, newest first. Open any entry for full detail, references, and exploit status.
24 CVEsRSS
CVE-2026-90851Medium· 6.3PoCA flaw has been found in PHPGurukul Hostel Management System 3.0
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the a…
CVE-2026-90850Low· 2.4PoCA vulnerability was detected in PHPGurukul Hostel Management System 3.0
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be lau…
CVE-2026-90846High· 7.3PoCA vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is …
CVE-2026-90845Low· 3.5PoCA flaw has been found in PHPGurukul Daily Expense Tracker System 1.1
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. …
CVE-2026-90844High· 7.3PoCA vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injec…
CVE-2026-90842Low· 3.7PoCA weakness has been identified in PHPGurukul Blood Donor Management System 1.0
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_Model.php. This manipulation of the argument password/email/c…
CVE-2026-90841High· 7.3PoCA security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The m…
CVE-2026-90840High· 7.3PoCA vulnerability was identified in PHPGurukul Blood Donor Management System 1.0
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to i…
CVE-2026-90519Medium· 6.3PoCA weakness has been identified in PHPGurukul Bank Locker Management System 1.0
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remo…
CVE-2026-90517Medium· 5.3PoCA vulnerability was identified in PHPGurukul Bank Locker Management System 1.0
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack ma…
CVE-2026-90575Low· 3.7PoCA weakness has been identified in PHPGurukul Small CRM 4.0
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. I…
CVE-2026-90518Medium· 6.3PoCA security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0
A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may …
CVE-2025-57145Medium· 5.4A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application
A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arb…
CVE-2022-35156Critical· 9.8Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
CVE-2022-35155Medium· 6.1PoCBus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
CVE-2022-33075Medium· 5.4PoCA stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
CVE-2022-31897Medium· 6.1PoCSourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.
SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.
CVE-2022-31384Critical· 9.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.
CVE-2022-31383Critical· 9.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.
CVE-2022-31382Critical· 9.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.
CVE-2022-29005Medium· 6.1PoCMultiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname o…
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname o…
CVE-2022-29004Medium· 6.1PoCDiary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.
CVE-2020-22168High· 7.5PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
CVE-2020-25487High· 7.8PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.