Hospital Management System (Phpgurukul) - vulnerabilities (CVEs)

64 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2026-02-18. Vendor: Phpgurukul.

CVEs of Hospital Management System

CVE-2025-70064 - CVSS 8.8 (high), 2026-02-18: PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the…
CVE-2025-70063 - CVSS 6.5 (medium), 2026-02-18: The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application…
CVE-2025-70062 - CVSS 6.5 (medium), 2026-02-18: PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to…
CVE-2026-2179 - CVSS 7.2 (high), 2026-02-08: A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This…
CVE-2026-2134 - CVSS 7.2 (high), 2026-02-08: A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file…
CVE-2026-1550 - CVSS 8.8 (high), 2026-01-28: A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file…
CVE-2025-56216 - CVSS 8.5 (high), 2025-08-25: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter.
CVE-2025-56215 - CVSS 6.5 (medium), 2025-08-25: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in contact.php via the pagetitle parameter.
CVE-2025-56214 - CVSS 9.8 (critical), 2025-08-25: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter.
CVE-2025-56212 - CVSS 9.8 (critical), 2025-08-25: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter.
CVE-2025-8955 - CVSS 9.8 (critical), 2025-08-14: A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The…
CVE-2025-8954 - CVSS 9.8 (critical), 2025-08-14: A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The…
CVE-2025-7604 - CVSS 9.8 (critical), 2025-07-14: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as critical. Affected by this vulnerability is an unknown…
CVE-2025-7176 - CVSS 9.8 (critical), 2025-07-08: A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown…
CVE-2025-6613 - CVSS 5.4 (medium), 2025-06-25: A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality…
CVE-2025-6570 - CVSS 8.8 (high), 2025-06-24: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown…
CVE-2025-5584 - CVSS 5.4 (medium), 2025-06-04: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as problematic. Affected is an unknown function of the file…
CVE-2024-51360 - CVSS 9.8 (critical), 2025-05-23: An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file
CVE-2024-56990 - CVSS 4.5 (medium), 2025-01-21: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php.
CVE-2024-56997 - CVSS 4.2 (medium), 2025-01-21: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter.
CVE-2024-56998 - CVSS 4.2 (medium), 2025-01-21: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address.
CVE-2024-11675 - CVSS 5.4 (medium), 2024-11-26: A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown…
CVE-2024-10807 - CVSS 5.1 (medium), 2024-11-05: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown processing of the…
CVE-2024-10806 - CVSS 5.1 (medium), 2024-11-05: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the…
CVE-2024-46238 - CVSS 5.9 (medium), 2024-10-21: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /admin/add-doctor.php and…
CVE-2024-46239 - CVSS 5.9 (medium), 2024-10-21: Multiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-profile.php and…
CVE-2024-46237 - CVSS 5.4 (medium), 2024-10-09: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) via the patname, pataddress, and medhis parameters in…
CVE-2022-46498 - CVSS 2.7 (low), 2024-03-07: Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.
CVE-2022-46499 - CVSS 8.8 (high), 2024-03-07: Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php.
CVE-2022-46497 - CVSS 8.1 (high), 2024-03-07: Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php.
CVE-2020-26629 - CVSS 9.8 (critical), 2024-01-10: A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload…
CVE-2020-26628 - CVSS 6.1 (medium), 2024-01-10: A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML…
CVE-2020-26627 - CVSS 4.9 (medium), 2024-01-10: A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a…
CVE-2020-26630 - CVSS 4.9 (medium), 2024-01-10: A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a…
CVE-2024-0361 - CVSS 9.8 (critical), 2024-01-10: A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file…
CVE-2024-0364 - CVSS 9.8 (critical), 2024-01-10: A vulnerability, which was classified as critical, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file…
CVE-2024-0363 - CVSS 9.8 (critical), 2024-01-10: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown…
CVE-2024-0362 - CVSS 9.8 (critical), 2024-01-10: A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of…
CVE-2024-0360 - CVSS 9.8 (critical), 2024-01-10: A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file…
CVE-2024-0286 - CVSS 6.1 (medium), 2024-01-07: A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file…
CVE-2023-7173 - CVSS 5.4 (medium), 2023-12-30: A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file…
CVE-2023-7172 - CVSS 7.3 (high), 2023-12-30: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown…
CVE-2023-31498 - CVSS 9.8 (critical), 2023-05-11: A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access…
CVE-2021-35388 - CVSS 5.4 (medium), 2022-10-28: Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.
CVE-2021-35387 - CVSS 8.8 (high), 2022-10-28: Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.
CVE-2022-42205 - CVSS 5.4 (medium), 2022-10-21: PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via add-patient.php.
CVE-2022-42206 - CVSS 5.4 (medium), 2022-10-21: PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.php, admin/view-patient.php, and…
CVE-2022-24226 - CVSS 7.5 (high), 2022-02-15: Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
CVE-2022-24646 - CVSS 7.5 (high), 2022-02-10: Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg…
CVE-2022-24263 - CVSS 9.8 (critical), 2022-01-31: Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.
CVE-2021-39411 - CVSS 6.1 (medium), 2021-11-05: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a)…
CVE-2020-22172 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unauthenticated users can exploit the…
CVE-2020-22175 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\admin\betweendates-detailsreports.php. Remote unauthenticated…
CVE-2020-22168 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the…
CVE-2020-22171 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\registration.php. Remote unauthenticated users can exploit the…
CVE-2020-22174 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\book-appointment.php. Remote unauthenticated users can exploit the…
CVE-2020-22170 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unauthenticated users can exploit the…
CVE-2020-22173 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\edit-profile.php. Remote unauthenticated users can exploit the…
CVE-2020-22176 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can…
CVE-2020-22169 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\appointment-history.php. Remote unauthenticated users can exploit…
CVE-2020-22167 - CVSS 5.4 (medium), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a Persistent Cross-Site Scripting vulnerability in \hms\admin\appointment-history.php. Remote registered…
CVE-2020-22166 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php. Remote unauthenticated users can exploit the…
CVE-2020-22165 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the…
CVE-2020-22164 - CVSS 7.5 (high), 2021-06-22: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\check_availability.php. Remote unauthenticated users can exploit…
CVE-2020-35745 - CVSS 8.8 (high), 2021-01-07: PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users,…
CVE-2020-25271 - CVSS 5.4 (medium), 2020-10-08: PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php,…
CVE-2020-5193 - CVSS 6.1 (medium), 2020-01-14: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter.
CVE-2020-5191 - CVSS 6.1 (medium), 2020-01-06: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
CVE-2020-5192 - CVSS 8.8 (high), 2020-01-06: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user…