CVE-2025-13468

MediumCVSS 5.4

Published: 20/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

A weakness was identified in SourceCodester Alumni Management System 1.0 affecting delete_forum/delete_career/delete_comment/delete_gallery/delete_event in admin/admin_class.php (Delete Handler). Manipulating the ID argument leads to missing authorization, and the attack can be launched remotely. The exploit is publicly available.

Risk Assessment

Missing authorization checks allow an attacker to delete data without privileges, potentially causing data loss or destruction. The public exploit facilitates abuse.

Recommendation

Enforce authorization checks before delete operations in admin_class.php and restrict access to the admin panel; update the product if a fix is available.

Other vulnerabilities in SourceCodester Alumni Management System

CVE-2025-13059Medium
A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

Original NVD description (English source)

A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS