CVE-2025-70062: Cross-Site Request Forgery (CSRF)
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 09:08 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 18 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
1. Implement robust CSRF protections by enforcing CSRF token validation on all state-changing endpoints, especially add-doctor.php. 2. Restrict access to sensitive administrative modules using strong authentication and role-based access controls. 3. Employ Content Security Policy (CSP) headers and SameSite cookies to reduce the risk of CSRF and cross-origin attacks. 4. Conduct regular security audits and code reviews to identify and remediate missing security controls. 5. Educate administrators and privileged users about phishing and social engineering risks to reduce the likelihood of visiting malicious pages. 6. Monitor logs for unusual account creation activities and implement anomaly detection to quickly identify potential exploitation attempts. 7. If possible, isolate the hospital management system from the public internet or restrict access via VPN or secure network segments. 8. Engage with the vendor or development team to obtain patches or updates addressing this vulnerability as soon as they become available.
Description
PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to enforce CSRF token validation on the add-doctor.php endpoint. This allows remote attackers to create arbitrary Doctor accounts (privileged users) by tricking an authenticated administrator into visiting a malicious page.