September 20, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-90575NVD

Description

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.
Severity Level
LOW (3.7)
Published Date
13/09/2026
Last Modified
16/09/2026
Exploitation Status
????
EPSS Score
0.46% (percentile 39.4%)

CVSS Base Metrics

CVSS v3 (3.1)
LOW 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
CVSS v4 (4.0)
MEDIUM 6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Weaknesses (CWE)

CWE-502 - DeserializationCWE-20 - Improper Input Validation

Affected & Patched Versions

ProductAffected VersionsPatched Version
PHPGurukul Small CRM4.0N/A
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.

References