CVE-2025-70062: phpgurukul hospital_management_system Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2025-70062 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in phpgurukul hospital_management_system. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 18-02-2026
   PublishedVulnerability first disclosed.
2. 18-02-2026
   Last modifiedVulnerability information updated.

Description

PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to enforce CSRF token validation on the add-doctor.php endpoint. This allows remote attackers to create arbitrary Doctor accounts (privileged users) by tricking an authenticated administrator into visiting a malicious page.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.