CVE-2026-1160

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	Directory Management System	1.0

References

https://github.com/YouSeeYouOneDayDayDe/Nick_1321_vuls/issues/2Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://phpgurukul.com/Product
https://vuldb.com/?ctiid.341754Permissions Required, VDB Entry
https://vuldb.com/?id.341754Third Party Advisory, VDB Entry
https://vuldb.com/?submit.736333Third Party Advisory, VDB Entry

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-116004.3The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a miss CVE-2026-1160007.3A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file CVE-2026-1160037.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-1160043.5A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/c CVE-2026-1160067.3A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file Au CVE-2026-1160073.7A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateS CVE-2026-1160084.3DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated CVE-2026-1160098.8Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files CVE-2026-116015.3The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all CVE-2026-1160104.3RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students out CVE-2026-1160117.5Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to cra CVE-2026-1160123.6Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that