Vulnerabilidades do Phpgurukul Hospital Management System
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Phpgurukul Hospital Management System: 6 registro(s), com versões afetadas e correções.cpe:2.3:a:phpgurukul:hospital_management_system
CVE-2025-70064
Alta · 8.8
CWE-284 18/02/2026
Improper Access Control em Phpgurukul Hospital Management System
PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing to the /admin/ directory after authentication. This allows any self-registered user to takeover the application, view confidential logs, and modify system data.
CVE-2025-70063
Média · 6.5
CWE-639 18/02/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Phpgurukul Hospital Management System
The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.
CVE-2025-70062
Média · 6.5
CWE-352 18/02/2026
Cross-Site Request Forgery (CSRF) em Phpgurukul Hospital Management System
PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to enforce CSRF token validation on the add-doctor.php endpoint. This allows remote attackers to create arbitrary Doctor accounts (privileged users) by tricking an authenticated administrator into visiting a malicious page.
CVE-2026-2179
Alta · 7.2
CWE-74 08/02/2026
PHPGurukul Hospital Management System manage-users.php sql injection
A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-2134
Alta · 7.2
CWE-89 08/02/2026
PHPGurukul Hospital Management System manage-doctors.php sql injection
A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/manage-doctors.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVE-2026-1550
Alta · 8.8
CWE-266 28/01/2026
PHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization
A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminviews.py of the component Admin Dashboard Page. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.