CVE-2026-90518
MediumCVSS 6.3Summary
A security flaw was discovered in PHPGurukul Bank Locker Management System 1.0 in sidebar.php. Manipulation of the UserType argument results in improper access controls and the attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
Improper access controls may allow an attacker to gain higher privileges or access protected functions. Public availability of the exploit increases the risk.
Recommendation
Verify and strengthen access control mechanisms based on the UserType argument. Updating to a version containing the fix is recommended.
Other vulnerabilities in Bank Locker Management System
See all- CVE-2026-90519Medium
A weakness was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/banker/add-locker-form.php. Manipulation of the addressproof argument causes unrestricted upload and the attack can be performed remotely. The exploit is publicly available and could be used for attacks.
- CVE-2026-90517Medium
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/view-assign-locker.php. Manipulation of the ltid argument leads to authorization bypass and the attack may be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.