CVE-2026-90845: PHPGurukul Expense Tracker XSS Flaw

CVE-2026-90845 Overview

CVE-2026-90845 is a cross-site scripting (XSS) vulnerability [CWE-79] in PHPGurukul Daily Expense Tracker System 1.1. The flaw resides in the /dets/includes/sidebar.php file and stems from improper handling of the FullName argument. An authenticated attacker can inject arbitrary JavaScript that executes in the context of a victim's browser session. The attack is remotely exploitable and requires user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic use against exposed installations.

Critical Impact
Attackers can execute arbitrary script in an authenticated user's browser, enabling session data theft, UI defacement, or phishing pivots against Daily Expense Tracker System 1.1 users.

Affected Products

PHPGurukul Daily Expense Tracker System 1.1
The /dets/includes/sidebar.php component
Installations exposing the FullName parameter to untrusted input

Discovery Timeline

2026-09-15 - CVE-2026-90845 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database
2026-09-16 - EPSS scoring data published

Technical Details for CVE-2026-90845

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the sidebar component of the Daily Expense Tracker System. Input passed via the FullName argument reaches the rendered HTML output of /dets/includes/sidebar.php without adequate encoding or sanitization. When a targeted user loads a crafted request, the browser interprets attacker-supplied markup as executable script.

Exploitation requires an authenticated session with low privileges and depends on user interaction, such as clicking a crafted link. The attack executes over the network against the web application front end. Because the sidebar renders across authenticated pages, injected payloads can operate within the same-origin context of the application.

Root Cause

The root cause is missing output encoding on the FullName value before it is embedded in the HTML sidebar template. PHP applications must apply contextual escaping, such as htmlspecialchars() with ENT_QUOTES and a specified charset, whenever user-controlled data is written into markup. The absence of this control in sidebar.php allows script tags and event handlers to render intact.

Attack Vector

An attacker with valid but low-privilege credentials submits a payload that stores or reflects into the FullName field. When a user loads any page that includes /dets/includes/sidebar.php, the browser parses and executes the injected script. The payload can exfiltrate cookies accessible to JavaScript, perform actions on behalf of the user, or rewrite page contents to support credential harvesting.

Because the exploit has been publicly documented on external tracking sites, defenders should assume proof-of-concept payloads are in circulation. See the VulDB CVE-2026-90845 record and GitHub Issue Discussion for additional technical detail.

Detection Methods for CVE-2026-90845

Indicators of Compromise

HTTP requests to /dets/ endpoints containing FullName parameters with <script>, onerror=, onload=, or javascript: substrings
Server access logs showing repeated submissions of encoded or obfuscated HTML in profile or expense update fields
Outbound browser requests from user sessions to unfamiliar domains shortly after loading Daily Expense Tracker pages

Detection Strategies

Deploy web application firewall rules that inspect the FullName parameter for HTML tags, script fragments, and common XSS obfuscation patterns
Enable content security policy (CSP) violation reporting to surface script executions from unexpected sources within the application
Review database rows storing user profile data for entries containing HTML markup or JavaScript event handlers

Monitoring Recommendations

Correlate authenticated session activity with anomalous DOM interactions or credential submission events
Monitor privileged administrator sessions for signs of session takeover following visits to pages rendering the sidebar
Track failed login attempts spikes that could follow successful cookie or credential theft

How to Mitigate CVE-2026-90845

Immediate Actions Required

Restrict access to the Daily Expense Tracker System 1.1 application to trusted networks or VPN users until a patched version is available
Audit stored FullName values in the application database and remove entries containing HTML or script content
Rotate session identifiers and force reauthentication for accounts that may have loaded attacker-controlled sidebar content

Patch Information

No vendor advisory or fixed release has been published for CVE-2026-90845 at the time of writing. Administrators should monitor PHPGurukul for an updated build of the Daily Expense Tracker System and apply it as soon as it is released. Until then, treat the affected installation as exposed and apply the workarounds below.

Workarounds

Add a reverse-proxy or WAF rule that rejects FullName values containing angle brackets, quotes, or on*= event handler patterns
Modify /dets/includes/sidebar.php locally to wrap the FullName output in htmlspecialchars($fullname, ENT_QUOTES, 'UTF-8') before rendering
Enforce a strict Content-Security-Policy header that disallows inline scripts and restricts script sources to trusted origins
Limit account creation to trusted users to reduce the pool of low-privilege accounts capable of injecting payloads

bash

# Configuration example
# Example NGINX rule to block obvious XSS payloads in the FullName parameter
if ($arg_FullName ~* "(<|>|script|onerror|onload|javascript:)") {
    return 403;
}

# Example Content-Security-Policy header for the application vhost
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;