CVE-2026-90844

5.5 mediumEPSS 0.4%

Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-09-15
Modified: 2026-09-15
Record from: the NVD, synced 2026-10-19

References

https://github.com/usernamevnq/CVEs/issues/4
https://phpgurukul.com/
https://vuldb.com/cve/CVE-2026-90844
https://vuldb.com/submit/925668
https://vuldb.com/vuln/403396

Check your stack JSON