Is CVE-2026-90846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90846 being exploited in the wild.

How severe is CVE-2026-90846?

High severity, with a CVSS score of 7.3, published 15 September 2026.

Which products and versions are affected?

Phpgurukul Daily Expense Tracker System 1.1.

Is there a fix for CVE-2026-90846?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90846 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90846?

Check whether you run Phpgurukul Daily Expense Tracker System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90846: PHPGurukul Daily Expense Tracker SQL injection in password reset

CVE-2026-90846 · Severity: high · CVSS 7.3 · Published 2026-09-15

PHPGurukul Daily Expense Tracker System is a PHP-based web application for tracking personal expenses. An unauthenticated attacker can exploit SQL injection vulnerabilities in the password reset flow to take over any user account without knowing their credentials. The attacker can reset a target user's password and gain full access to their account and expense data.

Technologies: Phpgurukul Daily Expense Tracker System. Vendors: Phpgurukul.

Quick answers

Is CVE-2026-90846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90846 being exploited in the wild.
How severe is CVE-2026-90846?: High severity, with a CVSS score of 7.3, published 15 September 2026.
Which products and versions are affected?: Phpgurukul Daily Expense Tracker System 1.1.
Is there a fix for CVE-2026-90846?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90846 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90846?: Check whether you run Phpgurukul Daily Expense Tracker System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a pre-authentication SQL injection (CWE-89) in the forgot-password and reset-password flows (/dets/forgot-password.php and /dets/reset-password.php). The affected code directly concatenates unsanitized user input from the email and contactno POST parameters into SQL SELECT and UPDATE queries without using prepared statements or input validation. An attacker can inject SQL via the email field (e.g., email=' OR '1'='1' LIMIT 1-- -) to bypass authentication checks, set arbitrary session variables, and then modify the password reset query to target a specific user. No authentication or email verification is required. The attack is remotely exploitable and has been publicly disclosed. Patches should use parameterized queries and implement secure token-based password reset mechanisms.

Affected products

PHPGurukul Daily Expense Tracker System 1.1

Timeline

2026-08-12: disclosed: Vulnerability disclosed on GitHub by Vy Tien Dat and Hoang Dinh Hieu
2026-09-15: advisory: CVE-2026-90846 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.