Privilege Escalation Vulnerability in PHPGurukul Hospital Management System
CVE-2025-70064

8.8HIGH

Key Information:

Vendor

PHPGurukul
Status
Hospital Management System
Vendor
CVE Published:
18 February 2026

What is CVE-2025-70064?

The Hospital Management System v4.0 by PHPGurukul is susceptible to a privilege escalation flaw that enables low-privileged users, such as patients, to gain unauthorized access to the Administrator Dashboard. By navigating directly to the /admin/ directory post-authentication, these users can access critical sub-modules including User Logs and Doctor Management, compromising sensitive data and system integrity. This vulnerability allows self-registered users to manipulate system information and breach confidentiality protocols.

References

https://gist.github.com/Sanka1pp/c6f20cd6db1fbb1f0e7e199e...
https://packetstorm.news/files/id/213711

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.