CVE-2025-61148

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Dec 4, 2025

CISA due date

—

The record

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed