CVE-2026-5837
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PHPGurukul News Portal Project 4.1 has a SQL injection vulnerability in /news-details.php via the Comment argument. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
The risk is remote SQL injection, potentially leading to unauthorized database access and data leakage.
Recommendation
Immediately validate and sanitize input for the Comment argument, and consider upgrading or replacing the system.
Other vulnerabilities in PHPGurukul News Portal
See all- CVE-2025-12616Low
A vulnerability was detected in PHPGurukul News Portal 1.0 affecting an unknown function in /onps/settings.py. Manipulation results in insertion of sensitive information into debugging code. The attack can be initiated remotely, but its complexity is rated as high and exploitability as difficult. The exploit is now public and may be used.
- CVE-2025-12615Medium
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS