Skip to main content

Hospital Management System CVE-2025-70063

MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-02-18 cve@mitre.org
Authentication Bypass Hospital Management System
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Feb 26, 2026 - 22:33 vuln.today
Public exploit code
CVE Published
Feb 18, 2026 - 19:21 nvd
MEDIUM 6.5

DescriptionCVE.org

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

AnalysisAI

Hospital Management System versions up to 4.0 is affected by authorization bypass through user-controlled key (CVSS 6.5).

Technical ContextAI

This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects Hospital Management System. The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the confidential medical records of other patients by iterating the 'viewid' integer.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Hospital Management System

View all
CVE-2023-43958 CRITICAL POC
9.8 Apr 22

An arbitrary file upload vulnerability in the component /jquery-file-upload/server/php/index.php of Hospital Management

CVE-2020-26629 CRITICAL POC
9.8 Jan 10

A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows
CVE-2024-40502 CRITICAL POC
9.8 Jul 22

SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute ar
CVE-2023-4176 CRITICAL POC
9.8 Aug 06

A vulnerability was found in SourceCodester Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vul
CVE-2023-3811 CRITICAL POC
9.8 Jul 21

A vulnerability was found in Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-3810 CRITICAL POC
9.8 Jul 21

A vulnerability was found in Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-3809 CRITICAL POC
9.8 Jul 21

A vulnerability was found in Hospital Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-31498 CRITICAL POC
9.8 May 11

A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
CVE-2022-38637 CRITICAL POC
9.8 Sep 13

Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Pa
CVE-2022-32095 CRITICAL POC
9.8 Jul 01

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orde
CVE-2022-32094 CRITICAL POC
9.8 Jul 01

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doc
CVE-2022-32093 CRITICAL POC
9.8 Jul 01

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adm

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-70063 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy