Phpgurukul News Portal vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Phpgurukul News Portal: 8 record(s), with affected versions and fixes.cpe:2.3:a:phpgurukul:news_portal
CVE-2026-1424
High · 7.2
CWE-284 Jan 26, 2026
PHPGurukul News Portal Profile Pic unrestricted upload
A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVE-2026-1142
Medium · 6.5
CWE-352 Jan 19, 2026
PHPGurukul News Portal cross-site request forgery
A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-1141
High · 8.8
CWE-266 Jan 19, 2026
PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization
A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component Add Sub-Admin Page. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2025-69992
Critical · 9.8
CWE-125 Jan 13, 2026
Out-of-bounds Read in Phpgurukul News Portal
phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
CVE-2025-69991
Critical · 9.8
CWE-89 Jan 13, 2026
SQL Injection in Phpgurukul News Portal
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
CVE-2025-69990
Critical · 9.1
CWE-552 Jan 13, 2026
Files or Directories Accessible to External Parties in Phpgurukul News Portal
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
CVE-2025-12616
Medium · 5.9
CWE-200 Nov 3, 2025
PHPGurukul News Portal settings.py insertion of sensitive information into debugging code
A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
CVE-2025-12615
High · 8.1
CWE-320 Nov 3, 2025
PHPGurukul News Portal settings.py hard-coded key
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key
. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.