CVE-2025-10595
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
SourceCodester Online Student File Management System 1.0 has a SQL injection vulnerability in /admin/delete_user.php via the user_id argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
SQL injection could allow an attacker to read, modify, or delete database data, compromising data confidentiality and integrity.
Recommendation
Apply vendor patches or implement parameterized SQL queries and restrict access to the admin panel.
Other vulnerabilities in SourceCodester Online Student File Management System
See all- CVE-2025-10594Medium
A SQL Injection vulnerability was found in SourceCodester Online Student File Management System 1.0 in the file /admin/delete_student.php. By manipulating the stud_id argument, an attacker can execute arbitrary SQL queries. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.
- CVE-2025-10593Medium
A vulnerability was detected in SourceCodester Online Student File Management System 1.0 in an unknown function of /admin/update_student.php. Manipulation of the stud_id argument results in SQL injection, and the attack can be initiated remotely. The exploit is now public.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Online Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/delete_user.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS