CVE-2025-61148

PoC ×2—

CVSS 3.1

6.5 medium

EPSS

<1%p28

Published

Dec 4, 2025 (Dec 4, 2025)

Modified

Jun 17, 2026

Description

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Vendors: edupluscampus
Products: edupluscampus
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.