CVE-2026-90519
Received Received - Intake

Unrestricted File Upload in PHPGurukul Bank Locker Management System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90519
EUVD
EUVD-2026-77007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpgurukul bank_locker_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in PHPGurukul Bank Locker Management System 1.0. The issue occurs in the /blms/banker/add-locker-form.php file where the addressproof argument lacks proper validation. Attackers can upload malicious files without restrictions, leading to remote code execution.

Detection Guidance

Check for unrestricted file uploads in the /blms/banker/add-locker-form.php file, particularly for the addressproof parameter. Look for PHP files uploaded to the addressproof/ directory without proper validation. Inspect file extensions and MIME types in upload requests.

Impact Analysis

An attacker with valid credentials could upload a PHP webshell via the addressproof field. This allows them to execute arbitrary commands on the server, access sensitive data like customer PII or banker credentials, modify/delete files, and potentially gain full control of the system.

Compliance Impact

This vulnerability could lead to severe compliance violations. Exposure of customer PII violates GDPR's data protection requirements. For HIPAA, unauthorized access to protected health information would be a breach. Both regulations mandate strict access controls and data protection measures.

Mitigation Strategies

Restore commented-out file extension validation for the addressproof field. Implement MIME type verification for uploaded files. Move the addressproof/ directory outside the web root or protect it with .htaccess rules. Update default passwords and audit for SQL injection vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90519. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart