Phpgurukul Small Crm vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Phpgurukul Small Crm: 7 record(s), with affected versions and fixes.cpe:2.3:a:phpgurukul:small_crm
CVE-2026-90575
Low · 3.7
CWE-20 Sep 13, 2026
PHPGurukul Small CRM Login Success login.php unserialize deserialization
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.
CVE-2025-15390
High · 8.8
CWE-862 Dec 31, 2025
PHPGurukul Small CRM edit-user.php authorization
A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2024-44648
Medium · 6.5
CWE-89 Nov 17, 2025
SQL Injection in Phpgurukul Small Crm
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
CVE-2024-44647
Medium · 6.1
CWE-79 Nov 17, 2025
Cross-site Scripting (XSS) in Phpgurukul Small Crm
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php.
CVE-2024-44644
Medium · 6.5
CWE-89 Nov 17, 2025
SQL Injection in Phpgurukul Small Crm
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.
CVE-2024-44641
Medium · 6.5
CWE-89 Nov 17, 2025
SQL Injection in Phpgurukul Small Crm
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php.
CVE-2025-11053
Critical · 9.8
CWE-89 Sep 27, 2025
PHPGurukul Small CRM forgot-password.php sql injection
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.