CVE-2025-14256CWE-74CWE-89sql-injection

CVE-2025-14256

High · published December 8, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

⚠️ Uh-oh! A sneaky SQL injection vulnerability lurks in itsourcecode's Student Management System 1.0, specifically in the /newcurriculm.php file, just waiting for a crafty attacker to manipulate an ID argument! Think of this vulnerability like a restaurant with a poorly designed menu that lets diners order from the kitchen without any oversight. Just one bad order could spoil the entire meal for everyone! An attacker could exploit this flaw to access or manipulate your database directly, compromising sensitive student information. While it's not being actively exploited yet, the fact that it's public knowledge makes it a potential threat you can't ignore. ⚡

Put simply

Think of this vulnerability like a restaurant with a poorly designed menu that lets diners order from the kitchen without any oversight. Just one bad order could spoil the entire meal for everyone! This vulnerability allows for SQL injection by manipulating the ID parameter in the /newcurriculm.php file, enabling attackers to execute malicious queries against the database remotely.

What to do

An attacker could exploit this flaw to access or manipulate your database directly, compromising sensitive student information. While it's not being actively exploited yet, the fact that it's public knowledge makes it a potential threat you can't ignore. ⚡ To protect yourself, update the Student Management System to the latest version as soon as possible and ensure that you are using parameterized queries to prevent SQL injection. Regularly review your code for similar vulnerabilities! You’ve got this! With a few quick updates, you can fortify your defenses and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-08T22:16Z
Affected products (1)
ProductVersionsFixed in
angeljudesuarez/student_management_systemall versions—
References (6)
EPSS history
Timeline
  • 08 DEC 16:32Z
    itsourcecode Student Management System newcurriculm.php sql injection
    cvelistv5