CVE-2026-5839
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was identified in PHPGurukul News Portal Project 4.1 within the file /admin/add-subcategory.php. Manipulation of the sucatdescription argument allows SQL code injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
This vulnerability could allow an attacker to gain unauthorized access to the database, modify or steal data. The public availability of the exploit increases the risk of exploitation.
Recommendation
Immediately update the application to a patched version or apply input filtering fixes. Until updated, restrict access to the administrative panel.
Other vulnerabilities in PHPGurukul News Portal Project
See all- CVE-2025-69992Critical
phpgurukul News Portal Project V4.1 has a File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
- CVE-2025-69991Critical
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
- CVE-2025-69990Critical
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
- CVE-2026-5840Medium
A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- CVE-2026-5838Medium
A SQL injection vulnerability was determined in PHPGurukul News Portal Project 4.1 affecting the file /admin/add-subadmins.php. Manipulation of the sadminusername argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in PHPGurukul News Portal Project 4.1. This issue affects some unknown processing of the file /admin/add-subcategory.php. Such manipulation of the argument sucatdescription leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS