CVE-2026-5839 is a medium severity SQL injection vulnerability in PHPGurukul News Portal Project version 4.1. It arises from improper handling of the sucatdescription parameter in the /admin/add-subcategory.php file, allowing remote attackers with high privileges to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 5.1. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-5838 is a medium severity SQL injection vulnerability in PHPGurukul News Portal Project version 4.1. It affects the /admin/add-subadmins.php file, where manipulation of the sadminusername parameter can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2026-5814 is a medium severity SQL injection vulnerability in PHPGurukul Online Course Registration version 3.1. It arises from improper handling of the 'regno' parameter in the /admin/check_availability.php file, allowing remote attackers to inject SQL commands. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. Exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected system's data.
CVE-2026-5813 is a medium-severity SQL injection vulnerability in PHPGurukul Online Course Registration version 3.1. The issue exists in the /check_availability.php file where manipulation of the 'cid' parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although a public exploit is available, there is no confirmed patch or official remediation at this time.
CVE-2026-5641 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects an unknown function in the /admin/update-image1.php file, specifically through manipulation of the 'filename' parameter. The vulnerability can be exploited remotely without user interaction or elevated privileges. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.
CVE-2026-5640 is a medium-severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability exists in an unknown function within the /admin/update-image2.php file, where manipulation of the filename parameter allows remote attackers to perform SQL injection. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available.
CVE-2026-5639 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /admin/update-image3.php file within the Parameter Handler component, where manipulation of the 'filename' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-5636 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects the /cancelorder.php file where the 'oid' parameter is improperly handled, allowing remote attackers to inject SQL commands. The vulnerability is publicly known, but no official patch or remediation guidance has been provided yet. Exploitation could lead to unauthorized database queries or data manipulation.
CVE-2026-5635 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /categorywise-products.php file, specifically in the handling of the 'cid' parameter. This vulnerability allows remote attackers to manipulate the SQL query via the 'cid' argument, potentially leading to unauthorized database access or modification. The exploit code has been publicly released, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and is limited to the specified product version.
CVE-2026-5606 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /order-details.php file where the orderid parameter is improperly handled, allowing remote attackers to inject SQL code. This vulnerability could potentially allow unauthorized access or manipulation of the backend database. No official patch or remediation guidance is currently available from the vendor. Exploits in the wild are not known at this time.
CVE-2026-5583 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability exists in the /my-profile.php file within the Parameter Handler component, where manipulation of the 'fullname' argument can lead to SQL injection. This flaw can be exploited remotely without user interaction. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.
A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the component Parameter Handler. Performing a manipulation of the argument paymethod results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
A flaw has been found in PHPGurukul PHPGurukul Online Shopping Portal Project up to 2.1. Impacted is an unknown function of the file /pending-orders.php of the component Parameter Handler. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This issue affects some unknown processing of the file /sub-category.php of the component Parameter Handler. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. Performing a manipulation of the argument Subject 1 results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-course.php. Such manipulation of the argument Course Short Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/manage-doctors.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
