The vulnerability CVE-2026-90844 affects PHPGurukul Daily Expense Tracker System version 1.1. It is a SQL injection flaw located in the /dets/index.php file's Login component. By manipulating the email parameter, an attacker can perform SQL injection attacks remotely without authentication. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. Exploit code is publicly available, but no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary SQL commands on the backend database via the email parameter. This can lead to unauthorized data access, data modification, or other database impacts depending on the backend configuration. The vulnerability does not require authentication or user interaction, increasing its risk.

No official patch or remediation guidance is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and parameterized queries to mitigate SQL injection risks in the affected component.