CVE-2026-90519

PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability in PHPGurukul Bank Locker Management System 1.0, specifically the add-locker-form.php script located under /blms/banker, allows an attacker to upload arbitrary files by manipulating the addressproof argument. The flaw consists of missing file type validation (CWE-434) and absence of an authorization check (CWE-284), enabling uncontrolled file placement on the server. If the uploaded file is executable by the web server, the attacker can achieve remote code execution, compromising confidentiality, integrity, and availability of the application.

Affected Systems

The only affected product is PHPGurukul Bank Locker Management System 1.0; the issue resides in the add-locker-form.php script within this version.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% reflects a low anticipated probability of exploitation in the wild. The vulnerability is not listed Attackers who can reach the /blms/banker/add-locker-form.php endpoint, which may be protected by authentication, can manipulate the addressproof argument to upload arbitrary files; if the server permits execution of the uploaded content, remote code execution becomes possible.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade to a newer version of PHPGurukul Bank Locker Management System that fixes the unrestricted upload flaw.
  • Implement server‑side validation that accepts only allowed file types and rejects all others before storing the file.
  • Store uploaded files in a directory that resides outside the web root and configure file permissions to prevent execution.
  • Disable execution of scripts in the upload directory and, if necessary, use web‑server configuration or .htaccess rules to block MIME type execution.

Generated by OpenCVE AI on September 15, 2026 at 17:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Title PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload
First Time appeared Phpgurukul
Phpgurukul bank Locker Management System
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:phpgurukul:bank_locker_management_system:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul bank Locker Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 15, 2026, 2:00 PM
Reserved
Sep 12, 2026, 9:31 AM

View source JSON

Updated
Sep 15, 2026, 1:42 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 1:16 PM
Modified
Sep 15, 2026, 3:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 6:00 PM

JSON