PHPGurukul vulnerabilities
We track 653 vulnerabilities in PHPGurukul products across 60+ products. 653 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest PHPGurukul vulnerabilities
- 7.6 High severity
user_registration_and_login_and_user_management…: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail paramet
- 7.6 High severity
user_registration_and_login_and_user_management…: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL command via the fromdate parameter in a POST HTTP request.
- 7.6 High severity
user_registration_and_login_and_user_management…: Improper Control of Generation of Code
A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request.
- 9.8 Critical severity
Online Shopping Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql inject
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, and retrieve all the information stored in it.
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrieve all the information stored in it.
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the information stored in it.
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrieve all the information stored in it.
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, and retrieve all the information stored in it.
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it.
- 7.5 High severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it.
- 8.8 High severity
Job Portal: Unrestricted Upload of File with Dangerous Type
File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via webshell.
- 9.8 Critical severity
old_age_home_management_system: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "email" parameter.
- 9.8 Critical severity
Online Bookstore: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file book.php. The manipulation of the argument bookisbn leads to sql injection. The attack may be launch
- 9.1 Critical severity
online_fire_reporting_system: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input
- 7.2 High severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/normal-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection
- 9.8 Critical severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/foreigner-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql inject
- 9.8 Critical severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. This affects an unknown part of the file /admin/foreigner-search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to i
- 9.8 Critical severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/normal-search.php. The manipulation of the argument searchdata leads to sql injection. The att
- 9.8 Critical severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection.
- 9.8 Critical severity
Directory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Directory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack may be
- 8.8 High severity
Online Course Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Online Course Registration System 3.1. Affected by this vulnerability is an unknown functionality of the file /pincode-verification.php. The manipulation of the argument pincode leads to sql inject
- 9.8 Critical severity
Online Course Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function of the file /onlinecourse/. The manipulation of the argument regno leads to sql injection. It is possible to launch the a
- 9.8 Critical severity
Online Course Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been rated as critical. This issue affects some unknown processing of the file news-details.php. The manipulation of the argument nid leads to sql injection. The attack may b
- 9.8 Critical severity
Online Course Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username/password leads to sql injection. Th
- 8.8 High severity
Doctor Appointment Management System: Authorization Bypass Through User-Controlled Key
A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknown functionality of the file /doctor/view-appointment-detail.php. The manipulation of the argument edi
- 9.8 Critical severity
client_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "searchdata" parameter.
- 9.8 Critical severity
client_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "todate" and "fromdate" parameters.
- 9.8 Critical severity
cyber_cafe_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the upid parameter in the /view-user-detail.php file.
- 7.3 High severity
cyber_cafe_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the compname parameter in /edit-computer-detail.php file.
- 9.8 Critical severity
cyber_cafe_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in /edit-computer-detail.php in phpgurukul Cyber Cafe Management System Using PHP & MySQL v1.0 allows attackers to run arbitrary SQL commands via editid in the application URL.
- 8.1 High severity
Tourism Management System: Unrestricted Upload of File with Dangerous Type
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image.
- 8.8 High severity
tourism_management_system: Unrestricted Upload of File with Dangerous Type
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php. When creating a new package, there is no checks for what types of files are uploaded from the image.
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functionality of the file /edit-subject.php. The manipulation of the argument sub1/sub2/sub3/sub4/udate leads to sql injection
- 9.8 Critical severity
Student Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage-courses.php?del=1. The manipulation of the argument del leads to sql injection. T
- 9.8 Critical severity
Student Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /login.php. The manipulation of the argument id/password leads to sql injection. It is possible to launch the att
- 9.8 Critical severity
News Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul/itsourcecode News Portal 4.1. This issue affects some unknown processing of the file search.php. The manipulation of the argument searchtitle leads to sql injection. The attack may
- 8.8 High severity
News Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. The attack can be initiated re
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul Small CRM 3.0. Affected by this issue is some unknown functionality of the component Registration Page. The manipulation leads to sql injection. The attack may be launched remotely
- 8.8 High severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Small CRM 3.0. Affected by this vulnerability is an unknown functionality of the component Change Password Handler. The manipulation leads to sql injection. The attack can be launched remotely. The