The vulnerability exists in the login.php file of PHPGurukul Small CRM 4.0, where a user-controlled parameter named geopluginURL is directly passed to PHP’s unserialize() function. Attackers canerialized during this process, the attacker could potentially cause PHP code execution, compromising the system. Deserialization in PHP is commonly associated with code‑execution risks.

The only product affected is PHPGurukul Small CRM version 4.0. No other versions or products are listed as impacted in the available data.

The CVSS base score of 6.3 indicates moderate severity. The vulnerability is remote; an attacker only needs to send a specially crafted request to the login endpoint. The EPSS score is less than 1%, indicating a very low probability of exploitation, though the publicly available exploit code and high complexity suggest that only well‑prepared adversaries are likely to succeed. It is not listed in CISA KEV. Given the moderate score and the potential for serious impact, organizations should promptly review their patch state.