CVE-2025-12332
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A flaw has been found in SourceCodester Student Grades Management System 1.0 in the delete_user function of /admin.php. Manipulation leads to cross site scripting. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to session hijacking or admin account takeover.
Recommendation
Update the system to the latest version or apply security patches immediately. Also validate and sanitize input data in the delete_user function.
Other vulnerabilities in SourceCodester Student Grades Management System
See all- CVE-2026-9486Medium
A CSRF vulnerability has been discovered in SourceCodester Student Grades Management System 1.0. An unknown part allows CSRF attacks that can be executed remotely. The exploit has been made public and may be used in attacks.
- CVE-2026-9485Low
A cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0 in the students.php file via the Remarks argument. Remote attack is possible. Exploit is publicly available.
- CVE-2025-63892Medium
A stored cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0. The create_classroom function in /classroom.php fails to sanitize the name/description arguments, allowing script injection.
Original NVD description (English source)
A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS