CVE-2025-61148

CVE-2025-61148CVE-2025-61148

edupluscampus / edupluscampus

Description

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Scoring

CVSS 6.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Last modified2026-11-04
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.