Vulnerability · Published Sep 14, 2026 · Assigned by VulDB
CVE-2026-90840PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication
High 7.3
In plain English
A high-severity improper authentication in Blood Donor Management System from PHPGurukul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPGurukul | Blood Donor Management System | 1.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-403392 | PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication vdb-entry, technical-description
- VDB-403392 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-90840 | CVE Analysis and Report third-party-advisory
- Submit #925615 | PHPGurukul Blood Donor Management System Using CodeIgniter 1.0 Improper Authentication third-party-advisory
- https://github.com/usernamevnq/CVEs/issues/1 exploit, issue-tracking
- https://phpgurukul.com/ product