CVE-2026-90575: phpgurukul small_crm Improper Input Validation

Vulnerability summary

CVE-2026-90575 is a medium (CVSS 6.3) Improper Input Validation vulnerability in phpgurukul small_crm. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-09-2026
   PublishedVulnerability first disclosed.
2. 16-09-2026
   Last modifiedVulnerability information updated.

Description

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.