CVE Intelligence
Analysis AI-assisted

CVE-2026-2088: PHPGurukul Beauty Parlour Management System SQL Injection via delid

A SQL injection flaw has been reported in PHPGurukul Beauty Parlour Management System 1.1, in the administrative file /admin/accepted-appointment.php, through the delid argument. NVD assigns a CVSS 3.1 base score of 9.8 (Critical), and the record states that the exploit has been publicly disclosed. The sources consulted do not list a fixed version or confirmed exploitation in the wild.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an SQL injection issue in PHPGurukul Beauty Parlour Management System 1.1. The weakness is reachable through the delid argument of the administrative page /admin/accepted-appointment.php. VulDB is the CNA, and the record classifies the weakness as CWE-74 (Injection).

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (Critical). The vector indicates network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • VulDB provides alternative scores of 7.3 (CVSS 3.1), 5.5 (CVSS 4.0) and 7.5 (CVSS 2.0).
  • A successful SQL injection may allow an attacker to read or alter database content. The exact data exposed by this application is not described in the record.

Affected products and versions

  • Phpgurukul Beauty Parlour Management System, version 1.1, as listed in the record.
  • Other versions: unknown. The record does not state a version range.
  • Fixed versions: none listed in the record. This does not confirm that no fix exists.

Exploitation status

  • The record shows no CISA KEV listing. No confirmed active exploitation appears in the sources consulted.
  • The record states that the exploit has been publicly disclosed and may be used. A GitHub issue tagged as Exploit is among the references.

Remediation and mitigation

  • No vendor fix is listed in the record. Check the product vendor at PHPGurukul and treat the application as unpatched until a fix is confirmed.
  • Restrict access to administrative pages to trusted networks and accounts.
  • Ask developers to use parameterized queries and strict server-side input validation on the affected endpoint.
  • If no fix is available, consider replacing or removing the application from exposed environments.
  • Review database account privileges so that the application account has only the access it needs.

Detection guidance

  • Review web server logs for requests to accepted-appointment.php with unusual or malformed values in the delid parameter.
  • Monitor database error messages and unexpected query patterns originating from the web application.
  • Alert on access to administrative paths from unexpected external addresses.

Limitations of the available information

  • No fixed version, patch or vendor advisory is listed in the record.
  • The record does not state the authentication required to reach the affected page. One VulDB entry is tagged Permissions Required, but the privileges needed are not specified.
  • The record has no KEV data beyond a negative listing. Its EPSS value is 0.00429 with percentile 0.35405, dated 2026-10-13.
  • The source record has no title, so the title above was written from the product name and weakness class.

Frequently asked questions

What is the vulnerability in CVE-2026-2088?

It is an SQL injection issue in PHPGurukul Beauty Parlour Management System 1.1, reachable through the delid argument of /admin/accepted-appointment.php. NVD scores it 9.8 under CVSS 3.1.

Is there a fixed version or confirmed exploitation?

The record lists no fixed version, and it does not list the CVE in CISA KEV. The record says the exploit is public, but no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.