CVE-2025-70064
HIGHPHPGurukul HMS 4.0 - Privilege Escalation
Title source: llmDescription
PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing to the /admin/ directory after authentication. This allows any self-registered user to takeover the application, view confidential logs, and modify system data.
Scores
CVSS v3
8.8
EPSS
0.0009
EPSS Percentile
25.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-284
Status
published
Affected Products (1)
phpgurukul/hospital_management_system
Timeline
Published
Feb 18, 2026
Tracked Since
Feb 18, 2026