CVE-2026-90840
Received Received - Intake

Improper Authentication in PHPGurukul Blood Donor Management System

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90840
EUVD
EUVD-2026-78222

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpgurukul blood_donor_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authentication issue in PHPGurukul Blood Donor Management System 1.0. The system fails to enforce authentication checks in five admin controllers, allowing unauthenticated attackers to access sensitive functions. Attackers can exploit this to view or manipulate user data, delete records, and access administrative features without logging in.

Detection Guidance

Check if any of the vulnerable admin controllers (Dashboard.php, Viewuser.php, Bloodgroup.php, Report.php, Changepwd.php) in PHPGurukul Blood Donor Management System 1.0 lack authentication constructors or have them commented out. Inspect the __construct function in /application/controllers/admin/ for missing authentication checks.

Impact Analysis

Unauthenticated attackers can access personal user data like names, emails, phone numbers, and blood types. They can delete user records, modify blood groups, and potentially extract passwords due to a combined SQL injection flaw. This could lead to identity theft, data breaches, or system compromise.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if medical data is exposed. It results in non-compliance with data protection requirements, risking legal penalties, reputational damage, and loss of trust due to improper access controls and data exposure.

Mitigation Strategies

Add proper authentication constructors to all admin controllers. Implement a base Admin_Controller class to enforce authentication. Enforce role-based access control. Remove or fix any commented-out authentication checks. Address the SQL injection in the Report controller to prevent database access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart