CVE-2026-90575— PHPGurukul Small CRM Login Success login.php unserialize deserialization
Quick assessment
Affected
PHPGurukul Small CRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PHPGurukul Small CRM 4.0 中已发现一个安全弱点，受影响的是组件“登录成功处理器”中文件 的 函数。通过操纵参数 会触发反序列化漏洞。该攻击可远程发起，但攻击复杂度较高，利用难度较大。相关漏洞的利用方式（exploit）已公开，可被用于实际攻击。
Possible ATT&CK Techniques 1 AI
T1059.001 · PowerShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PHPGurukul | Small CRM | 4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90575
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHPGurukul Small CRM Login Success login.php unserialize deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHPGurukul | Small CRM | 4.0 |
cpe:2.3:a:phpgurukul:small_crm:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-90575
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90575
请登录查看更多情报信息。
Proof of Concept for CVE-2026-90575 (1)
Security Blog Posts for CVE-2026-90575 (1)
Same Patch Batch · PHPGurukul · 2026-09-13 · 4 CVEs total
| CVE-2026-90518 | 6.3 MEDIUM | PHPGurukul Bank Locker Management System sidebar.php access control |
| CVE-2026-90519 | 6.3 MEDIUM | PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload |
| CVE-2026-90517 | 5.3 MEDIUM | PHPGurukul Bank Locker Management System view-assign-locker.php authorization |
IV. Related Vulnerabilities
Same product: Small CRM
-
CVE-2025-15390
PHPGurukul Small CRM edit-user.php authorization -
CVE-2025-11053
PHPGurukul Small CRM forgot-password.php sql injection -
CVE-2025-10664
PHPGurukul Small CRM create-ticket.php sql injection -
CVE-2025-10114
PHPGurukul Small CRM profile.php sql injection -
CVE-2025-10079
PHPGurukul Small CRM get-quote.php sql injection
Same vendor: PHPGurukul
-
CVE-2026-90519
PHPGurukul Bank Locker Management System add-locker-form.php -
CVE-2026-90518
PHPGurukul Bank Locker Management System sidebar.php access -
CVE-2026-90517
PHPGurukul Bank Locker Management System view-assign-locker. -
CVE-2026-82424
PHPGurukul Student Information System student_edit1.php sql -
CVE-2026-75089
PHPGurukul Complaint Management System check_availability.ph
Same weakness: CWE-502
-
CVE-2026-90614
FedML-AI FedML MQTT+S3 Communication Backend remote_storage. -
CVE-2026-90777
ESPnet before 202609 Remote Code Execution via Unsafe Deseri -
CVE-2026-90490
lenve vhr MailReceiver deserialization -
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object -
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object I
V. Comments for CVE-2026-90575
No comments yet