CVE-2025-61148: Edupluscampus

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Affected products

• Edupluscampus Edupluscampus: version 3.0.1 only

Published 2025-12-04. Last modified 2026-06-17.