CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
Explanation of Vulnerability in Simple Terms
Hospital Doctor Directory versions up to 1.3.9 contain an improper access control vulnerability. An authenticated user with low privileges can read, modify, or delete sensitive data and functionality across the application. The vulnerability requires a valid user account but no additional user interaction. Site administrators should update immediately to a version newer than 1.3.9.
What an attacker can do
Read, modify, or delete sensitive data and application functionality with a low-privilege user account.
Potential impact on your site
Any registered user can access and alter critical directory data, patient information, or system settings.
Conditions required to exploit
Attacker must have a valid user account with low privileges; no user interaction required.
Key dates
External resources
