CVE-2026-90575

LOW 3.7

PHPGurukul Small CRM Login Success login.php unserialize deserialization

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.

CWE	CWE-502 CWE-20
Vendor	phpgurukul
Product	small crm
Published	Sep 13, 2026

Stay Ahead of the Next One

Get instant alerts for phpgurukul small crm

Be the first to know when new low vulnerabilities affecting phpgurukul small crm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

PHPGurukul / Small CRM

4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/403160 vuldb.com: https://vuldb.com/vuln/403160/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90575 vuldb.com: https://vuldb.com/submit/913188 github.com: https://github.com/JdExploit/small-crm-login-unserialize phpgurukul.com: https://phpgurukul.com/

Credits

🔍 jdexploit (VulDB User)