CVE-2025-70063: phpgurukul hospital_management_system

Vulnerability summary

CVE-2025-70063 is a medium (CVSS 6.5) vulnerability in phpgurukul hospital_management_system. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 18-02-2026
   PublishedVulnerability first disclosed.
2. 18-02-2026
   Last modifiedVulnerability information updated.

Description

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.