Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.0
CVE-2026-105703: PHPGurukul login system lets password change without proper check
CVE-2026-105703 · published 13 days ago
Summary
The change-password feature in the PHPGurukul User Registration & Login and User Management System can be tricked into accepting a wrong current password, allowing someone to change any user's password. This can be done from outside the network, potentially giving an attacker control of user accounts. Apply the vendor's update or patch the script immediately and restrict remote access to the admin area.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| phpgurukul | user registration & login and user management system | 3.3 |
Original advisory text
PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-285Improper Authorization
CWE-863Incorrect Authorization
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Oct 2026
Track software like this
Free during beta