CVE-2026-90575
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.
Risk Assessment
The attack complexity is rather high and exploitability is said to be difficult, but the exploit has been made available to the public. If successful, an attacker could execute code or access application data.
Recommendation
Update PHPGurukul Small CRM to a version containing the fix or disable unsafe deserialization functions. It is also advisable to validate input and restrict access to login.php.
Other vulnerabilities in PHPGurukul Small CRM
Original NVD description (English source)
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.