CVE-2026-90842— PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file
Quick assessment
Affected
PHPGurukul Blood Donor Management System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PHPGurukul 血液捐献管理系统 1.0 中发现了一个安全弱点。该问题影响了 文件中某些未知功能。通过操纵参数 、 、 、 、 ，会导致敏感数据以明文形式存储在文件或磁盘上。该攻击可以远程发起，但攻击的复杂度较高，且实际利用较为困难。目前已公开了相关的利用方式，可能被用于发起攻击。
Possible ATT&CK Techniques 1 AI
T1123 · Audio Capture
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90842
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext storage in a file or on disk. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件或磁盘上的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHPGurukul | Blood Donor Management System | 1.0 |
cpe:2.3:a:phpgurukul:blood_donor_management_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-90842
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90842
请登录查看更多情报信息。
Proof of Concept for CVE-2026-90842 (1)
Security Blog Posts for CVE-2026-90842 (1)
Same Patch Batch · PHPGurukul · 2026-09-14 · 3 CVEs total
| CVE-2026-90840 | 7.3 HIGH | PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct impro |
| CVE-2026-90841 | 7.3 HIGH | PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection |
IV. Related Vulnerabilities
Same vendor: PHPGurukul
-
CVE-2026-90851
PHPGurukul Hostel Management System checklogin.php access co -
CVE-2026-90850
PHPGurukul Hostel Management System manage-students.php cros -
CVE-2026-90846
PHPGurukul Daily Expense Tracker System forgot-password.php -
CVE-2026-90845
PHPGurukul Daily Expense Tracker System sidebar.php cross si -
CVE-2026-90844
PHPGurukul Daily Expense Tracker System Login index.php sql
Same weakness: CWE-313
-
CVE-2026-14663
PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently -
CVE-2026-8804
Cleartext Storage of Sensitive Information for Puppet Resour -
CVE-2026-52783
OpenProject: Information Disclosure (cleartext storage of da -
CVE-2026-24349
Siemens SIMATIC WinCC Unified PC Runtime 安全漏洞 -
CVE-2025-4397
Medtronic MyCareLink Patient Monitor Data Encryption Weaknes
V. Comments for CVE-2026-90842
No comments yet