CVE-2025-12262
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
The vulnerability allows an attacker to manipulate database queries, potentially leading to unauthorized data access or modification.
Recommendation
Secure the application against SQL injection by using parameterized queries and input validation in /edit_criteria.php.
Other vulnerabilities in Online Event Judging System
See all- CVE-2025-12263Medium
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
- CVE-2025-12256Medium
The Online Event Judging System 1.0 by code-projects is vulnerable to SQL injection in /edit_contestant.php via the contestant_id argument. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2025-12255Medium
A security flaw has been discovered in code-projects Online Event Judging System 1.0. The file /add_contestant.php is affected. Manipulation of the argument fullname results in SQL injection. Remote exploitation is possible, and the exploit is public.
- CVE-2025-12254Medium
A vulnerability was identified in code-projects Online Event Judging System 1.0. The file /add_judge.php is affected. Manipulation of the argument fullname leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2025-12252Medium
A vulnerability was found in code-projects Online Event Judging System 1.0. The file /ajax/action.php is affected. Manipulation of the argument content results in SQL injection. The attack can be launched remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS