CVE-2025-10593
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Online Student File Management System 1.0 in an unknown function of /admin/update_student.php. Manipulation of the stud_id argument results in SQL injection, and the attack can be initiated remotely. The exploit is now public.
Risk Assessment
An attacker can remotely perform SQL injection, potentially leading to disclosure, modification, or deletion of data in the student file management system database.
Recommendation
Immediately secure the application by validating and parameterizing SQL queries, restrict access to the admin panel, and consider applying a vendor fix.
Other vulnerabilities in SourceCodester Online Student File Management System
See all- CVE-2025-10595Medium
SourceCodester Online Student File Management System 1.0 has a SQL injection vulnerability in /admin/delete_user.php via the user_id argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-10594Medium
A SQL Injection vulnerability was found in SourceCodester Online Student File Management System 1.0 in the file /admin/delete_student.php. By manipulating the stud_id argument, an attacker can execute arbitrary SQL queries. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/update_student.php. Performing manipulation of the argument stud_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS