CVE-2025-15052
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was detected in code-projects Student Information System 1.0 in the file /profile.php. Manipulation of the firstname/lastname arguments leads to cross-site scripting (XSS). The exploit is publicly available and can be used remotely.
Risk Assessment
XSS vulnerability may allow an attacker to execute malicious script in the victim's browser, steal sessions, or take over accounts. Public availability of the exploit increases the risk.
Recommendation
Update the software to a version that fixes the vulnerability, or apply proper input sanitization. Consider implementing Content Security Policy (CSP) to mitigate XSS effects.
Other vulnerabilities in Student Information System
See all- CVE-2025-13245Low
A cross-site scripting vulnerability was identified in code-projects Student Information System 2.0 in the /editprofile.php file. The attack can be launched remotely and a public exploit is available.
- CVE-2025-13244Medium
A vulnerability was determined in code-projects Student Information System 2.0 in /register.php. This manipulation causes cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in code-projects Student Information System 1.0. This vulnerability affects unknown code of the file /profile.php. Performing manipulation of the argument firstname/lastname results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS