PHPGurukul vulnerabilities
We track 653 vulnerabilities in PHPGurukul products across 60+ products. 653 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest PHPGurukul vulnerabilities
- 7.3 High severity
Daily Expense Tracker System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried
- 7.3 High severity
Daily Expense Tracker System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitati
- 7.3 High severity
Blood Donor Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argu
- 7.3 High severity
Blood Donor Management System: Improper Authentication
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication.
- 7.3 High severity
Complaint Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check_availability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the
- 7.3 High severity
Daily Expense Tracking System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul Daily Expense Tracking System 1.1. Affected is an unknown function of the file /register.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit ha
- 7.3 High severity
News Portal Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made publi
- 7.3 High severity
Online Course Registration: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1. This issue affects some unknown processing of the file /admin/check_availability.php. The manipulation of the argument regno leads to sql injection. The attack can be init
- 7.3 High severity
Online Course Registration: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /check_availability.php. Executing a manipulation of the argument cid can lead to sql injection. It is possible to launch the attac
- 8.8 High severity
Hospital Management System: Improper Access Control
PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing to the /admi
- 7.2 High severity
Hospital Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has
- 7.2 High severity
Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/manage-doctors.php. Such manipulation of the argument ID leads to sql injection. The attack may be perfo
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-appointment.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. Th
- 8.8 High severity
Hospital Management System: Incorrect Privilege Assignment
A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminviews.py of the component Admin Dashboard Page. Performing a manipulation results
- 7.2 High severity
News Portal: Improper Access Control
A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit is publicly available an
- 9.8 Critical severity
Directory Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipulation of the argument searchdata leads to sql injection. The attack may be init
- 8.8 High severity
News Portal: Incorrect Privilege Assignment
A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component Add Sub-Admin Page. Such manipulation leads to improper authorization. The attack can be launched re
- 8.8 High severity
Cyber Cafe Management System: Improper Neutralization of Special Elements used in an SQL Command
A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fails to properly sanitize user-supplied input provided via the adminname parameter, allowing authentica
- 9.8 Critical severity
Cyber Cafe Management System: Improper Neutralization of Special Elements used in an SQL Command
Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint.
- 9.8 Critical severity
News Portal: Out-of-bounds Read
phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
- 9.1 Critical severity
News Portal: Files or Directories Accessible to External Parties
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
- 8.8 High severity
Online Course Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of the argument studentregno/Pincode/session/department/level/course/sem results in sql injection. The a
- 8.8 High severity
Online Course Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/manage-students.php. This manipulation of the argument id/cid causes sql injection. It is possible to ini
- 8.7 High severity
Hostel Management System: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). When an
- 8.8 High severity
Online Course Registration: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in u
- 8.8 High severity
Online Course Registration: Missing Authorization
A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- 8.8 High severity
Small CRM: Missing Authorization
A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released t
- 7.5 High severity
Student Record System: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into submitting a forged request. This leads to the unauthorized deletion
- 9.8 Critical severity
Tourism Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /admin/user-bookings.php. The manipulation of the argument uid results in sql injection. It is possible to launch the attac
- 8.1 High severity
A security vulnerability has been detected in PHPGurukul News Portal 1.0.
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . The attack may be p
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/search-invoices.php. This manipulation of the argument searchdata causes sql injection. The attack can be initiate
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/search-appointment.php. The manipulation of the argument searchdata results in sql injection. It is possible
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The manipulation of the argument delid leads to sql injection. It is possible to initiate the attack remo
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-services.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be pe
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/invoices.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/customer-list.php. Such manipulation of the argument delid leads to sql injection. It is possible to laun
- 8.8 High severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports-detail.php. Such manipulation of the argument fromdate/todate leads to sql injection. The attack can
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The exploit has been mad
- 9.8 Critical severity
Park Ticketing Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST re
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argument subject can lead to sql injection. The attack may be launched remotely. The exploit has been pub