The vulnerability resides in the constructor of the Admin Dashboard controller, allowing an attacker to bypass the authentication check. By manipulating the request, unauthenticated users can instantiate the controller and gain access to administrative functions. This flaw can lead to unauthorized modification of donor records, administrator settings, and potentially exfiltration of sensitive personal data.

PHPGurukul’s Blood Donor Management System, version 1.0. No other versions were identified in the CNA data.

The CVSS score of 6.9 indicates moderate impact, and the EPSS score is less than 1% while the vulnerability is not listed in KEV, suggesting that the vulnerability has not yet been widely observed in the wild. Nevertheless, the description notes that the exploit is publicly available and can be triggered remotely, meaning that anyone with internet access can attempt the attack. Given the authentication bypass and remote attack vector, the risk to affected deployments is significant, warranting prompt remediation.