CVE-2025-13564CWE-404

CVE-2025-13564

Medium · published November 24, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/FilehelperController.php. Performing manipulation of the argument filepath results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2025-11-24T00:15Z
Affected products (1)
ProductVersionsFixed in
kimz190/pre-school_management_systemall versions—
References (5)
https://github.com/0xffaaa/cve/blob/main/Pre_School_Management_System_Arbitrary_File_Deletion_Vulnerabilit.md · [email protected]https://vuldb.com/?ctiid.333328 · [email protected]https://vuldb.com/?id.333328 · [email protected]https://vuldb.com/?submit.697083 · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 23 NOV 18:32Z
    SourceCodester Pre-School Management System FilehelperController.php removefile denial of service
    cvelistv5