Phpgurukul Hospital Management System vulnerabilities

CVE-2020-22165 [HIGH] CWE-89 CVE-2020-22165: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-log PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

CVE-2020-5192 [HIGH] CWE-89 CVE-2020-5192: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilitie PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised.

CVE-2022-24263 [CRITICAL] CWE-89 CVE-2022-24263: Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.

CVE-2020-26629 [CRITICAL] CWE-434 CVE-2020-26629: A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management Syst A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.

CVE-2025-70064 [HIGH] CWE-284 CVE-2025-70064: PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-priv PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing to the /admin/ directory after authentication. This allows any self-registered user to takeover the appli

CVE-2020-5191 [MEDIUM] CWE-79 CVE-2020-5191: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabiliti PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.

CVE-2026-1550 [HIGH] CWE-266 CVE-2026-1550: A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this i A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminviews.py of the component Admin Dashboard Page. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been

CVE-2025-7176 [CRITICAL] CWE-74 CVE-2025-7176: A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been declared as crit A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file view-medhistory.php. The manipulation of the argument viewid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may

CVE-2025-8955 [CRITICAL] CWE-74 CVE-2025-8955: A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affe A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The manipulation of the argument docfees leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7604 [CRITICAL] CWE-74 CVE-2025-7604: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as crit A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user-login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be

CVE-2025-6570 [HIGH] CWE-74 CVE-2025-6570: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown functionality of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be

CVE-2024-0362 [CRITICAL] CWE-89 CVE-2024-0362: A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affec A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250129 was assi

CVE-2021-39411 [MEDIUM] CWE-79 CVE-2021-39411: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4 Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.

CVE-2023-31498 [CRITICAL] CWE-384 CVE-2023-31498: A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a r A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter.

CVE-2024-51360 [CRITICAL] CWE-94 CVE-2024-51360: An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary cod An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file

CVE-2024-0360 [CRITICAL] CWE-89 CVE-2024-0360: A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critica A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/edit-doctor-specialization.php. The manipulation of the argument doctorspecilization leads to sql injection. The exploit has been disclosed to the public and may be used. The associated id

CVE-2024-0363 [CRITICAL] CWE-89 CVE-2024-0363: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file admin/patient-search.php. The manipulation of the argument searchdata leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250130 is the id

CVE-2025-8954 [CRITICAL] CWE-74 CVE-2025-8954: A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2020-35745 [HIGH] CWE-862 CVE-2020-35745: PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs.

CVE-2024-0361 [CRITICAL] CWE-89 CVE-2024-0361: A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file admin/contact.php. The manipulation of the argument mobnum leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250128.