CVE-2026-90517NVD

Description

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.

Severity Level

MEDIUM (5.3)

Published Date

13/09/2026

Last Modified

16/09/2026

Exploitation Status

????

EPSS Score

0.33% (percentile 26.9%)

CVSS Base Metrics

CVSS v3 (3.1)

MEDIUM 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

CVSS v4 (4.0)

MEDIUM 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Weaknesses (CWE)

CWE-639 - Authorization BypassCWE-285 - Improper Authorization

Affected & Patched Versions

Product	Affected Versions	Patched Version
PHPGurukul Bank Locker Management System	1.0	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.