CVE-2025-67404
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in save_stud.php via the fname, lname, and student_class parameters.
Risk Assessment
An attacker can add or modify student data, potentially leading to data integrity breaches and unauthorized access.
Recommendation
Update the system to the latest version or apply a patch to prevent SQL injection, e.g., by using prepared statements.
Other vulnerabilities in CASAP Automated Enrollment System
See all- CVE-2025-67403Critical
SQL Injection vulnerability in CASAP Automated Enrollment System 1.0. An attacker can inject malicious SQL via the class_name parameter in update_class.php.
- CVE-2025-67408High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in /save_user.php via the status parameter.
- CVE-2025-67407High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_student.php via the fname and student_class parameters.
- CVE-2025-67405High
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_password.php via the new_password parameter.
- CVE-2021-27332Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
- CVE-2021-3294Medium
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
Original NVD description (English source)
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.