CVE-2026-90518

PHPGurukul Bank Locker Management System sidebar.php access control

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability is a loss of proper access controls in the file sidebar.php of the PHPGurukul Bank Locker Management System. By manipulating the UserType argument, an attacker can bypass authentication checks and gain unauthorized access to privileged functions. The weakness is categorized as CWE‑266 (Improper Privilege Management) and CWE‑284 (Improper Access Control).

Affected Systems

PHPGurukul Bank Locker Management System version 1.0 is affected. No mitigations are indicated for earlier or newer versions; the vendor is PHPGurukul.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the vulnerability can be exploited remotely via crafted requests to sidebar.php. An EPSS score of less than 1% suggests a low probability of exploitation, but the presence of a publicly released exploit indicates that an attacker could opportunistically target exposed instances. The vulnerability is not listed in CISA’s KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Bank Locker Management System to a patched release that corrects the access‑control logic.
  • Modify the application to validate the UserType value against an exact whitelist of allowed roles before letting the request proceed.
  • Limit exposure of the sidebar.php endpoint by configuring the web server or firewall to allow access only from trusted IP ranges or internal hosts.

Generated by OpenCVE AI on September 15, 2026 at 16:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Title PHPGurukul Bank Locker Management System sidebar.php access control
First Time appeared Phpgurukul
Phpgurukul bank Locker Management System
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:phpgurukul:bank_locker_management_system:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul bank Locker Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 3:32 PM
Reserved
Sep 12, 2026, 9:31 AM

View source JSON

Updated
Sep 14, 2026, 3:32 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 12:17 PM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:00 PM

JSON