CVE-2026-90845
LowCVSS 3.5Summary
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.
Risk Assessment
An attacker can remotely execute a script in the user's browser context, potentially leading to data theft or session hijacking. The public exploit increases the risk.
Recommendation
It is recommended to update the system to the latest version or apply patches, and to properly filter input data.
Other vulnerabilities in PHPGurukul Daily Expense Tracker System
See all- CVE-2026-90846High
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. It affects an unknown function in the /dets/forgot-password.php file. Manipulation of the email/contactno argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-90844High
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. It affects unknown code in the file /dets/index.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.