Vulnerability · Published Jan 26, 2026 · Assigned by VulDB
CVE-2026-1424PHPGurukul News Portal Profile Pic unrestricted upload
Medium 4.7
In plain English
A medium-severity unrestricted file upload in News Portal from PHPGurukul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.5%top 59.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPGurukul | News Portal | 1.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-342840 | PHPGurukul News Portal Profile Pic unrestricted upload vdb-entry, technical-description
- VDB-342840 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- Submit #736637 | PHPGurukul News Portal v1.0 Cross Site Scripting third-party-advisory
- https://github.com/rsecroot/News-Portal/blob/main/Cross%20Site%20Scripting.md exploit
- https://phpgurukul.com/ product