CVE-2026-5838
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was determined in PHPGurukul News Portal Project 4.1 affecting the file /admin/add-subadmins.php. Manipulation of the sadminusername argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
This vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to data leakage or privilege escalation. The public exploit increases the likelihood of attack.
Recommendation
Urgently update the application to a patched version or implement input validation fixes. Also consider restricting access to the administrative interface.
Other vulnerabilities in PHPGurukul News Portal Project
See all- CVE-2025-69992Critical
phpgurukul News Portal Project V4.1 has a File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
- CVE-2025-69991Critical
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
- CVE-2025-69990Critical
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
- CVE-2026-5840Medium
A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- CVE-2026-5839Medium
A SQL injection vulnerability was identified in PHPGurukul News Portal Project 4.1 within the file /admin/add-subcategory.php. Manipulation of the sucatdescription argument allows SQL code injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in PHPGurukul News Portal Project 4.1. This vulnerability affects unknown code of the file /admin/add-subadmins.php. This manipulation of the argument sadminusername causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS