CVE-2025-67403
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
SQL Injection vulnerability in CASAP Automated Enrollment System 1.0. An attacker can inject malicious SQL via the class_name parameter in update_class.php.
Risk Assessment
Unauthorized database access, leakage or modification of sensitive data.
Recommendation
Use parameterized queries or prepared statements for the class_name parameter.
Other vulnerabilities in CASAP Automated Enrollment System
See all- CVE-2025-67404Critical
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in save_stud.php via the fname, lname, and student_class parameters.
- CVE-2025-67408High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in /save_user.php via the status parameter.
- CVE-2025-67407High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_student.php via the fname and student_class parameters.
- CVE-2025-67405High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_password.php via the new_password parameter.
- CVE-2021-27332Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
- CVE-2021-3294Medium
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
Original NVD description (English source)
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.