CVE-2026-5840
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion of application data.
Recommendation
Apply the vendor patch or mitigation as soon as possible; if no update is available, consider disabling the vulnerable file or implementing input filtering (WAF).
Other vulnerabilities in PHPGurukul News Portal Project
See all- CVE-2025-69992Critical
phpgurukul News Portal Project V4.1 has a File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
- CVE-2025-69991Critical
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
- CVE-2025-69990Critical
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
- CVE-2026-5839Medium
A SQL injection vulnerability was identified in PHPGurukul News Portal Project 4.1 within the file /admin/add-subcategory.php. Manipulation of the sucatdescription argument allows SQL code injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-5838Medium
A SQL injection vulnerability was determined in PHPGurukul News Portal Project 4.1 affecting the file /admin/add-subadmins.php. Manipulation of the sadminusername argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS