Threat database

CVE-2026-90518 is a medium severity vulnerability in PHPGurukul Bank Locker Management System version 1.0. It involves improper access controls due to manipulation of the UserType argument in the sidebar.php file. This flaw can be exploited remotely without user interaction and requires low privileges. Public exploit code is available.

CVE-2026-86517 is a medium severity SQL injection vulnerability affecting itsourcecode Sales and Inventory System version 1.0. The vulnerability exists in the mysqli_query function within the /pages/us_searchfrm.php file. An attacker can exploit this flaw remotely by manipulating the ID argument to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.

A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.