A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

A critical vulnerability has been identified in PHPGurukul Blood Donor Management System version 1.0. The flaw resides in the __construct function within the file /application/controllers/admin/Dashboard.php of the Admin Controllers component. The vulnerability allows manipulation leading to improper authentication, enabling attackers to bypass authentication controls. The attack can be initiated remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected product is a PHP-based web application used for managing blood donor records. Organizations using this system are urged to apply patches or mitigations immediately. The vulnerability has been catalogued under CVE-2026-90840 and tracked across multiple security databases including VulDB and NVD.