How to fix CVE-2025-70063?

Within 30 days: Identify affected systems running PHPGurukul Hospital Management System and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Is Hospital Management System affected by CVE-2025-70063?

Organizations using PHPGurukul Hospital Management System should be aware of notable risk from CVE-2025-70063, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.

CVE-2025-70063

MEDIUM

2026-02-18 [email protected]

6.5

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 22:33 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 19:21 nvd

MEDIUM 6.5

Description

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

Analysis

Hospital Management System versions up to 4.0 is affected by authorization bypass through user-controlled key (CVSS 6.5).

Technical Context

This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects Hospital Management System. The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

Affected Products

Vendor: Phpgurukul. Product: Hospital Management System. Versions: up to 4.0.

Remediation

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +32

POC: +20

CVE-2025-70063 vulnerability details – vuln.today

Back

CVE-2025-70063

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-70063

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code