CVE-2025-13325
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was determined in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /enrollment_edit1.php. Executing manipulation of the argument en_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
A remote attacker can exploit this vulnerability to inject malicious SQL and access student information system data, including personal data. This may lead to data confidentiality and integrity breaches.
Recommendation
Update the system to the latest version if a patch is available, or apply input filtering and query parameterization. Consider deploying a WAF and monitoring traffic for SQL injection attempts.
Other vulnerabilities in itsourcecode Student Information System
See all- CVE-2025-14214Medium
A vulnerability exists in an unknown part of the file /section_edit1.php in itsourcecode Student Information System 1.0. Manipulation of the ID argument leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed and may be used.
- CVE-2025-13581Medium
SQL injection vulnerability in /schedule_edit1.php of itsourcecode Student Information System 1.0. Manipulation of the schedule_id argument allows remote SQL injection. The exploit is publicly available.
- CVE-2025-10613Medium
A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A vulnerability was determined in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /enrollment_edit1.php. Executing manipulation of the argument en_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS