CVE-2026-90844
HighCVSS 7.3Summary
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. It affects unknown code in the file /dets/index.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker could gain unauthorized access to the database, potentially leading to data leakage or modification.
Recommendation
Apply vendor patches immediately or restrict access to the system. Also, use parameterized queries to prevent SQL injection.
Other vulnerabilities in PHPGurukul Daily Expense Tracker System
See all- CVE-2026-90846High
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. It affects an unknown function in the /dets/forgot-password.php file. Manipulation of the email/contactno argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-90845Low
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.