CVE-2026-0733

MEDIUM

Phpgurukul Online Course Registration System < 3.1 - Injection

Title source: rule

Description

A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/manage-students.php. This manipulation of the argument id/cid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

References (7)

[Exploit, Third Party Advisory] https://note-hxlab.wetolink.com/share/Tma34bofeB2L

[Exploit, Third Party Advisory] https://note-hxlab.wetolink.com/share/cU33RBoPPAF0

[Product] https://phpgurukul.com/

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.340130

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.340130

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.733328

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.733331

Scores

CVSS v3 6.3

EPSS 0.0002

EPSS Percentile 3.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-74 CWE-89

Status published

Affected Products (1)

phpgurukul/online_course_registration_system < 3.1

Timeline

Published Jan 09, 2026

Tracked Since Feb 18, 2026