Threat Intelligence Database

CVE-2026-5641 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects an unknown function in the /admin/update-image1.php file, specifically through manipulation of the 'filename' parameter. The vulnerability can be exploited remotely without user interaction or elevated privileges. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.

CVE-2026-5640 is a medium-severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability exists in an unknown function within the /admin/update-image2.php file, where manipulation of the filename parameter allows remote attackers to perform SQL injection. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available.

CVE-2026-5639 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /admin/update-image3.php file within the Parameter Handler component, where manipulation of the 'filename' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-5636 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects the /cancelorder.php file where the 'oid' parameter is improperly handled, allowing remote attackers to inject SQL commands. The vulnerability is publicly known, but no official patch or remediation guidance has been provided yet. Exploitation could lead to unauthorized database queries or data manipulation.

CVE-2026-5635 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /categorywise-products.php file, specifically in the handling of the 'cid' parameter. This vulnerability allows remote attackers to manipulate the SQL query via the 'cid' argument, potentially leading to unauthorized database access or modification. The exploit code has been publicly released, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and is limited to the specified product version.

CVE-2026-5583 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability exists in the /my-profile.php file within the Parameter Handler component, where manipulation of the 'fullname' argument can lead to SQL injection. This flaw can be exploited remotely without user interaction. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.

A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the component Parameter Handler. Performing a manipulation of the argument paymethod results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This issue affects some unknown processing of the file /sub-category.php of the component Parameter Handler. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's session, potentially leading to account takeover.

MediumVulnerabilityIndiaUnited StatesUnited Kingdom+7#cve#cve-2024-39090