CVE-2020-35745

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs.

• CWE-862

• https://medium.com/%40ashketchum/privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0Exploit, Third Party Advisory
• https://www.phpgurukul.com/hospital-management-system-in-php/Product, Third Party Advisory
• https://www.youtube.com/watch?v=vnSsg6iwV9Y&feature=youtu.be&ab_channel=ashketchumExploit, Third Party Advisory
• https://medium.com/%40ashketchum/privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0Exploit, Third Party Advisory
• https://www.phpgurukul.com/hospital-management-system-in-php/Product, Third Party Advisory
• https://www.youtube.com/watch?v=vnSsg6iwV9Y&feature=youtu.be&ab_channel=ashketchumExploit, Third Party Advisory

Published

Jan 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35738WavPack 5.3.0 has an out-of-bounds write in WavpackPackSampl…6.1
• CVE-2020-3574A vulnerability in the TCP packet processing functionality o…7.5
• CVE-2020-35740HGiga MailSherlock does not validate specific URL parameters…6.1
• CVE-2020-35741HGiga MailSherlock does not validate user parameters on mult…6.1
• CVE-2020-35742HGiga MailSherlock contains a vulnerability of SQL Injection…7.6
• CVE-2020-35743HGiga MailSherlock contains a SQL injection flaw. Attackers …7.6
• CVE-2020-35748Cross-site scripting (XSS) vulnerability in models/list-tabl…5.4
• CVE-2020-35749Directory traversal vulnerability in class-simple_job_board_…7.7
• CVE-2020-35752Baby Care System 1.0 is affected by a cross-site scripting (…5.4
• CVE-2020-35753The job posting recommendation form in Persis Human Resource…6.1
• CVE-2020-35754OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an a…7.2
• CVE-2020-35755An issue was discovered on Libre Wireless LS9 LS1.5/p7040 de…7.5