CVE-2026-90519
MediumCVSS 6.3Summary
A weakness was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/banker/add-locker-form.php. Manipulation of the addressproof argument causes unrestricted upload and the attack can be performed remotely. The exploit is publicly available and could be used for attacks.
Risk Assessment
Unrestricted file upload may allow an attacker to upload malicious code and take control of the system. Public availability of the exploit increases the risk.
Recommendation
Restrict file types and sizes for uploads and verify validation of the addressproof argument. Updating to a version containing the fix is recommended.
Other vulnerabilities in Bank Locker Management System
See all- CVE-2026-90518Medium
A security flaw was discovered in PHPGurukul Bank Locker Management System 1.0 in sidebar.php. Manipulation of the UserType argument results in improper access controls and the attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-90517Medium
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/view-assign-locker.php. Manipulation of the ltid argument leads to authorization bypass and the attack may be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.