CVE-2025-13581
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
SQL injection vulnerability in /schedule_edit1.php of itsourcecode Student Information System 1.0. Manipulation of the schedule_id argument allows remote SQL injection. The exploit is publicly available.
Risk Assessment
An attacker could access the database, steal or modify student data.
Recommendation
Apply vendor patch or use prepared statements to prevent SQL injection.
Other vulnerabilities in itsourcecode Student Information System
See all- CVE-2025-14214Medium
A vulnerability exists in an unknown part of the file /section_edit1.php in itsourcecode Student Information System 1.0. Manipulation of the ID argument leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed and may be used.
- CVE-2025-10613Medium
A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule_edit1.php. Such manipulation of the argument schedule_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS