A flaw discovered in the admin views file of PHPGurukul Hospital Management System 1.0 allows attackers to bypass authorization checks, leading to unauthorized access to administrative functions. The vulnerability resides in adminviews.py and can be exploited remotely through crafted HTTP requests. It falls under CWE‑266 (Improper Privilege Management) and CWE‑285 (Improper Authorization).

The affected product is PHPGurukul Hospital Management System version 1.0, released by vendor PHPGurukul. The flaw appears in the component managing admin pages, specifically the /hms/hospital/docappsystem/adminviews.py endpoint. No additional vendor or OS details are provided, and the scope appears limited to the admin dashboard functionality.

The CVSS v3.1 score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation so far. However, the vulnerability is remotely exploitable and an exploit has already been released to the public, meaning attackers can potentially use it to gain privileged access. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is through unauthorized HTTP requests to the admin views endpoint, so an attacker who can reach the web application could use the flaw to elevate privileges or manipulate sensitive data.