This vulnerability in PHPGurukul Blood Donor Management System 1.0 affects the handling of password-related parameters (password, email, currentpassword, dbcurrentpwd, newpassword) in the Login_Model.php file. It results in cleartext storage of these sensitive credentials on disk, which could be accessed by unauthorized parties. The attack vector is remote network access with no privileges or user interaction required, but the attack complexity is high. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity). Exploit code is publicly available, but exploitation is considered difficult.

Sensitive authentication credentials are stored in cleartext on disk, increasing the risk of credential disclosure if an attacker gains access to the file system. This could lead to unauthorized access or further compromise of the system. However, the attack complexity is high and no privileges or user interaction are required. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file system access permissions to limit exposure of stored credentials and monitor for unauthorized access attempts. Avoid using this version in production environments if possible.