Description
A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Published: 2026-04-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch
AI Analysis

Impact

The vulnerability resides in an unknown function within /admin/yesterday-reg-users.php of the PHPGurukul User Registration & Login and User Management System version 3.3. Manipulating the ID argument permits injection of arbitrary SQL statements, potentially allowing an attacker to read, modify, or delete database records. The CVE notes that remote exploitation is possible, indicating that a web request to the affected script can trigger the injection.

Affected Systems

All installations of PHPGurukul User Registration & Login and User Management System version 3.3 that expose the admin/yesterday-reg-users.php page to external users are at risk. The vendor is PHPGurukul, and no other product variants are listed as affected.

Risk and Exploitability

The CVSS score of 5.3 places this vulnerability in the medium severity range. EPSS data is not available, but the absence of an official patch and the presence of public exploitation code suggest that attackers can realistically target exposed systems. Because the attack vector is remote – an attacker can manipulate a URL parameter – the risk of exploitation is significant for publicly accessible deployments. The vulnerability is not cataloged in the CISA KEV list.

Generated by OpenCVE AI on April 5, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or upgrade to a newer version of the PHPGurukul system. If no patch exists, monitor the vendor’s website for updates.
  • Restrict access to /admin/yesterday-reg-users.php so that only authenticated administrators can reach the page.
  • Validate the ID parameter to accept only expected values or replace the insecure query with a prepared statement.
  • Audit database logs for suspicious queries and consider installing a Web Application Firewall to block injection attempts.

Generated by OpenCVE AI on April 5, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Phpgurukul
Phpgurukul user Registration & Login And User Management System
Vendors & Products Phpgurukul
Phpgurukul user Registration & Login And User Management System

Mon, 06 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Apr 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Title PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Phpgurukul User Registration & Login And User Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T16:26:03.334Z

Reserved: 2026-04-04T06:53:29.153Z

Link: CVE-2026-5543

cve-icon Vulnrichment

Updated: 2026-04-06T16:21:36.749Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T05:16:04.743

Modified: 2026-04-24T18:14:34.620

Link: CVE-2026-5543

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:57:10Z

Weaknesses