Skip to main content

Edupluscampus EUVD-2025-201212

| CVE-2025-61148 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2025-12-04 cve@mitre.org
Authentication Bypass Edupluscampus
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
EUVD ID Assigned
Mar 15, 2026 - 16:35 euvd
EUVD-2025-201212
Analysis Generated
Mar 15, 2026 - 16:35 vuln.today
PoC Detected
Dec 16, 2025 - 17:51 vuln.today
Public exploit code
CVE Published
Dec 04, 2025 - 16:16 nvd
MEDIUM 6.5

DescriptionCVE.org

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Analysis

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Technical ContextAI

This vulnerability is classified as Authorization Bypass Through User-Controlled Key (CWE-639).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Share

EUVD-2025-201212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy