CVE-2026-90851— PHPGurukul Hostel Management System checklogin.php access control
Quick assessment
Affected
PHPGurukul Hostel Management System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PHPGurukul 宿舍管理系统 3.0 中发现了一个缺陷。该缺陷影响文件 /admin/includes/checklogin.php 中的某个未知部分。对参数 ID 的操作导致了不当的访问控制。该漏洞可被远程利用，且利用代码已经公开，可能已被实际使用。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90851
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHPGurukul Hostel Management System checklogin.php access control
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHPGurukul | Hostel Management System | 3.0 |
cpe:2.3:a:phpgurukul:hostel_management_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-90851
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90851
请登录查看更多情报信息。
Proof of Concept for CVE-2026-90851 (1)
Security Blog Posts for CVE-2026-90851 (1)
Same Patch Batch · PHPGurukul · 2026-09-15 · 5 CVEs total
| CVE-2026-90846 | 7.3 HIGH | PHPGurukul Daily Expense Tracker System forgot-password.php sql injection |
| CVE-2026-90844 | 7.3 HIGH | PHPGurukul Daily Expense Tracker System Login index.php sql injection |
| CVE-2026-90845 | 3.5 LOW | PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting |
| CVE-2026-90850 | 2.4 LOW | PHPGurukul Hostel Management System manage-students.php cross site scripting |
IV. Related Vulnerabilities
Same product: Hostel Management System
-
CVE-2026-90850
PHPGurukul Hostel Management System manage-students.php cros -
CVE-2025-13577
PHPGurukul Hostel Management System register-complaint.php c -
CVE-2025-11119
itsourcecode Hostel Management System POST Request index.php -
CVE-2025-11040
code-projects Hostel Management System index.php sql injecti -
CVE-2025-10813
code-projects Hostel Management System index.php sql injecti
Same vendor: PHPGurukul
-
CVE-2026-90850
PHPGurukul Hostel Management System manage-students.php cros -
CVE-2026-90846
PHPGurukul Daily Expense Tracker System forgot-password.php -
CVE-2026-90845
PHPGurukul Daily Expense Tracker System sidebar.php cross si -
CVE-2026-90844
PHPGurukul Daily Expense Tracker System Login index.php sql -
CVE-2026-90842
PHPGurukul Blood Donor Management System Login_Model.php cle
Same weakness: CWE-284
-
CVE-2026-19290
IBM Sterling File Gateway is Vulnerable to Improper Access C -
CVE-2026-54628
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricte -
CVE-2026-76441
Cisco Secure Email Gateway Security Hardening Release -
CVE-2026-12258
Inadequate access control in the Hiperdino REST API -
CVE-2026-81566
Joomla Extension - joomshaper.com - Missing Access Control i
V. Comments for CVE-2026-90851
No comments yet