CVE-2025-12263
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Risk Assessment
An attacker could exploit SQL injection to read, modify, or delete database records, potentially compromising data integrity and confidentiality.
Recommendation
Use parameterized SQL queries or prepared statements to prevent injections, and restrict access to /edit_judge.php.
Other vulnerabilities in Online Event Judging System
See all- CVE-2025-12262Medium
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-12256Medium
The Online Event Judging System 1.0 by code-projects is vulnerable to SQL injection in /edit_contestant.php via the contestant_id argument. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2025-12255Medium
A security flaw has been discovered in code-projects Online Event Judging System 1.0. The file /add_contestant.php is affected. Manipulation of the argument fullname results in SQL injection. Remote exploitation is possible, and the exploit is public.
- CVE-2025-12254Medium
A vulnerability was identified in code-projects Online Event Judging System 1.0. The file /add_judge.php is affected. Manipulation of the argument fullname leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2025-12252Medium
A vulnerability was found in code-projects Online Event Judging System 1.0. The file /ajax/action.php is affected. Manipulation of the argument content results in SQL injection. The attack can be launched remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS