CVE-2026-90575

PHPGurukul Small CRM Login Success login.php unserialize deserialization

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability exists in the login.php file of PHPGurukul Small CRM 4.0, where a user-controlled parameter named geopluginURL is directly passed to PHP’s unserialize() function. Attackers canerialized during this process, the attacker could potentially cause PHP code execution, compromising the system. Deserialization in PHP is commonly associated with code‑execution risks.

Affected Systems

The only product affected is PHPGurukul Small CRM version 4.0. No other versions or products are listed as impacted in the available data.

Risk and Exploitability

The CVSS base score of 6.3 indicates moderate severity. The vulnerability is remote; an attacker only needs to send a specially crafted request to the login endpoint. The EPSS score is less than 1%, indicating a very low probability of exploitation, though the publicly available exploit code and high complexity suggest that only well‑prepared adversaries are likely to succeed. It is not listed in CISA KEV. Given the moderate score and the potential for serious impact, organizations should promptly review their patch state.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PHPGurukul Small CRM to a version that removes the unserialize() vulnerability on the geopluginURL parameter or apply any vendor‑released security patch.
  • If an upgrade is not immediately possible, modify the login.php script to eliminate or replace the unserialize() call for the geopluginURL input, ensuring that only expected data structures are accepted.
  • Apply strict input validation values for the geopluginURL parameter to prevent the passage of malicious serialized payloads.
  • Restrict direct access to the login endpoint by employing web‑application firewall rules or IP filtering to block unsolicited requests containing suspicious data.

Generated by OpenCVE AI on September 15, 2026 at 16:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.
Title PHPGurukul Small CRM Login Success login.php unserialize deserialization
First Time appeared Phpgurukul
Phpgurukul small Crm
Weaknesses CWE-20
CWE-502
CPEs cpe:2.3:a:phpgurukul:small_crm:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul small Crm
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-502

    Deserialization of Untrusted Data

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 16, 2026, 2:13 PM
Reserved
Sep 12, 2026, 4:27 PM

View source JSON

Updated
Sep 16, 2026, 2:13 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 6:16 PM
Modified
Sep 16, 2026, 3:18 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:45 PM

JSON