CVE-2025-70063

6.5 mediumEPSS 0.4%

Medium (6.5) in phpgurukul hospital management system. EPSS 0.4% chance of exploitation in the next 30 days.

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-02-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpgurukul:hospital_management_system

References

https://gist.github.com/Sanka1pp/f43c7eca5048152899e14412523afe80
https://packetstorm.news/files/id/213711

Check your stack JSON