VulnSea

PHPGurukul has 46 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 13 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 12. The median CVSS is 6.3 (medium), with 6 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-89 (22) and CWE-79 (15). Most affected products: beauty_parlour_management_system (7), Bank Locker Management System (3), Blood Donor Management System (3).

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
0% vs 1% corpus
Median CVSS
6.3
Publish → KEV
—
Last 90 days
13 prev 0

Products

  • beauty_parlour_management_system 7
  • Bank Locker Management System 3
  • Blood Donor Management System 3
  • Daily Expense Tracker System 3
  • curfew_e-pass_management_system 3
  • directory_management_system 3
Follow PHPGurukul:RSS feedSave a search →Embed badge ↗
46
Total CVEs
6
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

PHPGurukul vulnerabilities

CVEs affecting PHPGurukul, newest first. Open any entry for full detail, references, and exploit status.

46 CVEsRSS

CVE-2025-10624High· 7.3
1y ago

A security flaw has been discovered in PHPGurukul User Management System 1.0

A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument emailid results in sql injection. The attack can be initiated …

▾ Twilightphpgurukul · user_management_systemEPSS 0.48%via NVD
CVE-2025-57145Medium· 5.4
1y ago

A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application

A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arb…

▾ Sunlitphpgurukul · auto_taxi_stand_management_systemEPSS 0.18%via NVD
CVE-2025-40693Medium· 5.4
1y ago

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname',…

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname',…

▾ Sunlitphpgurukul · online_fire_reporting_systemEPSS 0.21%via NVD
CVE-2025-40690Critical· 9.8
1y ago

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.

▾ Midnightphpgurukul · online_fire_reporting_systemEPSS 0.33%via NVD
CVE-2025-10079High· 7.3
1y ago

A flaw has been found in PHPGurukul Small CRM 4.0

A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be execute…

▾ Twilightphpgurukul · small_crmEPSS 0.41%via NVD
CVE-2022-35156Critical· 9.8
4y ago

Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..

Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..

▾ Midnightphpgurukul · bus_pass_management_systemEPSS 1.4%via NVD
CVE-2022-35155Medium· 6.1PoC
4y ago

Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.

Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.

▾ Twilightphpgurukul · bus_pass_management_systemEPSS 2.6%via NVD
CVE-2022-33075Medium· 5.4PoC
4y ago

A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.

A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.

▾ Twilightphpgurukul · zoo_management_systemEPSS 0.64%via NVD
CVE-2022-31897Medium· 6.1PoC
4y ago

SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.

SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.

▾ Twilightphpgurukul · zoo_management_systemEPSS 0.90%via NVD
CVE-2022-31384Critical· 9.8
4y ago

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.

▾ Midnightphpgurukul · directory_management_systemEPSS 1.7%via NVD
CVE-2022-31383Critical· 9.8
4y ago

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.

▾ Midnightphpgurukul · directory_management_systemEPSS 1.7%via NVD
CVE-2022-31382Critical· 9.8
4y ago

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.

▾ Midnightphpgurukul · directory_management_systemEPSS 1.7%via NVD
CVE-2022-29005Medium· 6.1PoC
4y ago

Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname o…

Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname o…

▾ Twilightphpgurukul · online_birth_certificate_systemEPSS 2.2%via NVD
CVE-2022-29004Medium· 6.1PoC
4y ago

Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.

Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.

▾ Twilightphpgurukul · e-diary_management_systemEPSS 2.9%via NVD
CVE-2020-22168High· 7.5
5y ago

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

▾ Twilightphpgurukul · hospital_management_systemEPSS 2.2%via NVD
CVE-2020-25487High· 7.8
6y ago

PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.

PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.

▾ Twilightphpgurukul · zoo_management_systemEPSS 0.51%via NVD
PHPGurukul vulnerabilities (CVEs) — page 2 · VulnSea