We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-1424

CVE-2026-1424

PHP

Severity: MEDIUM
CVSS: 4.7CVSS
Published: 2026-01-26
Last modified: 2026-01-27
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-284CWE-434

Description

A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

References

https://github.com/rsecroot/News-Portal/blob/main/Cross%20Site%20Scripting.md
https://phpgurukul.com/
https://vuldb.com/?ctiid.342840
https://vuldb.com/?id.342840
https://vuldb.com/?submit.736637

Summary

Description

References