CVE-2025-12255
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A security flaw has been discovered in code-projects Online Event Judging System 1.0. The file /add_contestant.php is affected. Manipulation of the argument fullname results in SQL injection. Remote exploitation is possible, and the exploit is public.
Risk Assessment
The risk includes the possibility of unauthorized database access, data theft, or modification, which may compromise system integrity.
Recommendation
Immediately apply patches, validate input data, and use parameterized queries.
Other vulnerabilities in Online Event Judging System
See all- CVE-2025-12263Medium
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
- CVE-2025-12262Medium
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-12256Medium
The Online Event Judging System 1.0 by code-projects is vulnerable to SQL injection in /edit_contestant.php via the contestant_id argument. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2025-12254Medium
A vulnerability was identified in code-projects Online Event Judging System 1.0. The file /add_judge.php is affected. Manipulation of the argument fullname leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2025-12252Medium
A vulnerability was found in code-projects Online Event Judging System 1.0. The file /ajax/action.php is affected. Manipulation of the argument content results in SQL injection. The attack can be launched remotely, and the exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing manipulation of the argument fullname results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS