CVE-2026-90517
MediumCVSS 5.3Summary
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/view-assign-locker.php. Manipulation of the ltid argument leads to authorization bypass and the attack may be initiated remotely. The exploit is publicly available and might be used.
Risk Assessment
Authorization bypass may allow an attacker to access data or functions they should not be authorized for. Public availability of the exploit increases the risk.
Recommendation
Verify and strengthen authorization controls for the ltid argument. Updating to a version containing the fix is recommended.
Other vulnerabilities in Bank Locker Management System
See all- CVE-2026-90519Medium
A weakness was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/banker/add-locker-form.php. Manipulation of the addressproof argument causes unrestricted upload and the attack can be performed remotely. The exploit is publicly available and could be used for attacks.
- CVE-2026-90518Medium
A security flaw was discovered in PHPGurukul Bank Locker Management System 1.0 in sidebar.php. Manipulation of the UserType argument results in improper access controls and the attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Original NVD description (English source)
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.