CVE-2026-90851CWE-266CWE-284broken-access-control

CVE-2026-90851

Medium · published September 15, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00366 · 29.2th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published
2026-09-15T06:16Z
References (6)
https://github.com/usernamevnq/CVEs/issues/10 · [email protected]https://phpgurukul.com/ · [email protected]https://vuldb.com/cve/CVE-2026-90851 · [email protected]https://vuldb.com/submit/926972 · [email protected]https://vuldb.com/vuln/403406 · [email protected]https://vuldb.com/vuln/403406/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 02:00Z
    PHPGurukul Hostel Management System checklogin.php access control
    cvelistv5