Phpgurukul vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-57119 An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login functionCritical 9.8 · Sep 16, 2025
• CVE-2024-27685 SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload tHigh 7.1 · Jun 25, 2025
• CVE-2024-51360 An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php fileCritical 9.8 · May 23, 2025
• CVE-2024-55104 Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailiHigh 7.2 · Dec 16, 2024
• CVE-2024-55103 Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.High 7.2 · Dec 16, 2024
• CVE-2024-51208 File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the ImHigh 7.2 · Nov 20, 2024
• CVE-2024-8470 SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, aCritical 9.8 · Sep 5, 2024
• CVE-2024-8469 SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrievCritical 9.8 · Sep 5, 2024
• CVE-2024-8468 SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the iCritical 9.8 · Sep 5, 2024
• CVE-2024-8467 SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrievCritical 9.8 · Sep 5, 2024
• CVE-2024-8466 SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, Critical 9.8 · Sep 5, 2024
• CVE-2024-8465 SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and rCritical 9.8 · Sep 5, 2024
• CVE-2024-8464 SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.phpCritical 9.8 · Sep 5, 2024
• CVE-2023-49989 Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.Critical 9.8 · Mar 6, 2024
• CVE-2023-49988 Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.High 7.5 · Mar 6, 2024
• CVE-2020-26629 A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload aCritical 9.8 · Jan 10, 2024
• CVE-2023-48016 Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.High 7.5 · Nov 30, 2023
• CVE-2023-47445 Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.Critical 9.8 · Nov 15, 2023
• CVE-2023-41615 Zoo Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the Admin sign-in page via the username and password fields.Critical 9.8 · Sep 7, 2023
• CVE-2023-41594 Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the UsernaHigh 7.5 · Sep 7, 2023
• CVE-2023-38890 Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and poteHigh 8.8 · Aug 18, 2023
• CVE-2023-37687 Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the View Request of Nurse Page in the Admin portal.High 7.2 · Aug 8, 2023
• CVE-2023-37772 Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.High 8.8 · Jul 31, 2023
• CVE-2023-37771 Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.Critical 9.8 · Jul 31, 2023
• CVE-2023-31937 Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-cHigh 7.2 · Jul 28, 2023