CVE-2025-13245
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A cross-site scripting vulnerability was identified in code-projects Student Information System 2.0 in the /editprofile.php file. The attack can be launched remotely and a public exploit is available.
Risk Assessment
An attacker could execute malicious script in a user's browser, potentially stealing session or login data. Public exploit availability increases the likelihood of exploitation.
Recommendation
Update the application to a non-vulnerable version or implement input validation and encoding in /editprofile.php. Until patched, restrict access to the application.
Other vulnerabilities in Student Information System
See all- CVE-2025-15052Low
A vulnerability was detected in code-projects Student Information System 1.0 in the file /profile.php. Manipulation of the firstname/lastname arguments leads to cross-site scripting (XSS). The exploit is publicly available and can be used remotely.
- CVE-2025-13244Medium
A vulnerability was determined in code-projects Student Information System 2.0 in /register.php. This manipulation causes cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS