PHPGurukul vulnerabilities
We track 653 vulnerabilities in PHPGurukul products across 60+ products. 653 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest PHPGurukul vulnerabilities
- 9.8 Critical severity
Online Course Registration: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has b
- 9.8 Critical severity
User Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument emailid results in sql injection. The attack can be initiated remotely. The exploit h
- 9.8 Critical severity
Online Discussion Forum: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. This affects an unknown part of the file /admin/edit_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly
- 9.8 Critical severity
Online Discussion Forum: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in PHPGurukul Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_forum/search_result.php. Executing manipulation of the argument Search can lead to sql injection. The attack
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/all-appointment.php. The manipulation of the argument delid results in sql injection. The attack can be executed remotely. T
- 7.3 High severity
Student Result Management System: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This flaw allows an attacker to trick authenticated users into unintentionally modifying their account detai
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/view-enquiry.php. The manipulation of the argument viewid leads to sql injection. The attack is possible to be carried out re
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/readenq.php. Executing manipulation of the argument delid can lead to sql injection. The attack can be executed remotely. T
- 9.8 Critical severity
Online Fire Reporting System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'requestid' parameter in the endpoint '/ofrs/details.php'.
- 9.8 Critical severity
Online Fire Reporting System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'.
- 9.8 Critical severity
Online Fire Reporting System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.
- 9.8 Critical severity
Online Fire Reporting System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'remark', 'status' and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'.
- 9.8 Critical severity
Online Fire Reporting System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'mobilenumber', 'teamleadname' and 'teammember' parameters in the endpoint '/ofrs/admin/add-team.php'.
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made
- 8.8 High severity
User Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The manipulation of the argument uid results in sql injection. The attack may be performed from remote. The
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be executed remotely. The exploit
- 9.8 Critical severity
Online Course Registration: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.php. The manipulation of the argument semester leads to sql injection. It is possible to initiate the attack remotely. The
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. Such manipulation of the argument viewid leads to sql injection. The attack may be
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-image.php. This manipulation of the argument lid causes sql injection. The attack may be initiated re
- 7.6 High severity
Doctor Appointment Management System: Improper Neutralization of Input During Web Page Generation
In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the
- 7.2 High severity
Complaint Management System: Improper Neutralization of Input During Web Page Generation
phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter.
- 7.5 High severity
Complaint Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possible to be carried out r
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids[] results in sql injection. The attack can be executed
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The manipulation of the argument mobilenumber leads to sql injection. Remote exploitation of the attack is p
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/contact-us.php. The manipulation of the argument mobnumber results in sql injection. It is possible to launch the attack
- 8.8 High severity
User Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul User Management System 1.0. This impacts an unknown function of the file /admin/change-emailid.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely. The exploit has been
- 9.8 Critical severity
Online Course Registration: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /admin/student-registration.php. Performing manipulation of the argument studentname results in sql injection. The attack is possible
- 9.8 Critical severity
Online Course Registration: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This manipulation of the argument sesssion causes sql injection. The attack can be initiated remotely. The exploit has been pub
- 9.8 Critical severity
User Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the file /signup.php. Such manipulation of the argument emailid leads to sql injection. The attack can be executed remotely. The exploit is publ
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /book-appointment.php. The manipulation of the argument Message leads to sql injection. The attack can be launc
- 9.8 Critical severity
Online Shopping Portal Project: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.0. This vulnerability affects unknown code of the file /shopping/password-recovery.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated r
- 9.8 Critical severity
Online Shopping Portal Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.0. This affects an unknown part of the file shopping/bill-ship-addresses.php. The manipulation of the argument billingpincode leads to sql injection. It is possible to initiate the a
- 9.8 Critical severity
Online Shopping Portal Project: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in PHPGurukul Online Shopping Portal Project 2.0. Affected by this issue is some unknown functionality of the file /shopping/signup.php. The manipulation of the argument emailid leads to sql injection. The attack may be launched
- 9.8 Critical severity
Hospital Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The manipulation of the argument docfees leads to sql injection. The attack can be initiated remotely. The
- 9.8 Critical severity
Hospital Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the a
- 9.8 Critical severity
Teachers Record Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely.
- 9.8 Critical severity
Boat Booking System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add-boat.php. The manipulation of the argument boatname leads to sql injection. The attack can be initia
- 7.1 High severity
Improper session invalidation in the component /carrental/update-password.php of PHPGurukul…
Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijacking attack.
- 7.1 High severity
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online…
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.