CVE-2025-56216

Hospital Management System SQL Injection via pagetitle Parameter

phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hospital Management System

CVE-2025-56215

SQL Injection via pagetitle parameter in Hospital Management System 4.0

phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in contact.php via the pagetitle parameter.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hospital Management System

CVE-2025-56214

SQL Injection via Username Parameter in phpGurukul Hospital Management System 4.0

phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hospital Management System

CVE-2025-57147

SQL Injection in Complaint Management System 2.0

A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Complaint Management System

CVE-2025-57146

SQL Injection via mobileno in reset‑password functionality of Complaint Management System

phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Complaint Management System

CVE-2026-6193

PHPGurukul Daily Expense Tracking System register.php sql injection

A security flaw has been discovered in PHPGurukul Daily Expense Tracking System 1.1. Affected is an unknown function of the file /register.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Daily Expense Tracker System

CVE-2026-2179

PHPGurukul Hospital Management System manage-users.php sql injection

A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hospital Management System

CVE-2026-0730

PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting

A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UPDATE_STAFF of the file /staffleave/slms/slms/adminviews.py of the component SVG File Handler. Executing a manipulation of the argument profile_pic can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Staff Leave Management System

CVE-2026-0733

PHPGurukul Online Course Registration System manage-students.php sql injection

A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/manage-students.php. This manipulation of the argument id/cid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration System

CVE-2026-1424

PHPGurukul News Portal Profile Pic unrestricted upload

A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal

CVE-2026-0547

PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload

A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration

CVE-2026-0803

PHPGurukul Online Course Registration System enroll.php sql injection

A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of the argument studentregno/Pincode/session/department/level/course/sem results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration System

CVE-2026-1141

PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization

A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component Add Sub-Admin Page. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal

CVE-2026-1142

PHPGurukul News Portal cross-site request forgery

A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

News Portal

CVE-2026-1160

PHPGurukul Directory Management System Search index.php sql injection

A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Directory Management System

CVE-2026-1550

PHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization

A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminviews.py of the component Admin Dashboard Page. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hospital Management System

CVE-2026-2088

PHPGurukul Beauty Parlour Management System accepted-appointment.php sql injection

A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-appointment.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Beauty Parlour Management System

CVE-2026-2134

PHPGurukul Hospital Management System manage-doctors.php sql injection

A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/manage-doctors.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hospital Management System

CVE-2025-51414

Unrestricted File Upload in Phpgurukul Online Course Registration

In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration

CVE-2026-3402

PHPGurukul Student Record Management System edit-course.php cross site scripting

A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-course.php. Such manipulation of the argument Course Short Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Student Record Management System Student Record System