CVE-2025-14712CWE-497

CVE-2025-14712

High · published December 15, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

🚨 An unauthenticated page could spill the beans! Remote attackers can view sensitive info, including test accounts and passwords, in the Student Learning Assessment and Support System. ⚡ Think of it like a school brochure that accidentally lists all the students' report cards instead of just general information. A curious stranger could easily pick up this brochure and have access to private data without even having to knock on the school door! The ramifications could be absolutely devastating! An attacker could not only steal test accounts but also use that information to access sensitive student data. This breach could lead to identity theft, data manipulation, and a significant reputation loss for the institution.

Put simply

Think of it like a school brochure that accidentally lists all the students' report cards instead of just general information. A curious stranger could easily pick up this brochure and have access to private data without even having to knock on the school door! This vulnerability arises from a lack of proper authentication checks on a specific page within the system, allowing unauthorized access to sensitive information.

What to do

The ramifications could be absolutely devastating! An attacker could not only steal test accounts but also use that information to access sensitive student data. This breach could lead to identity theft, data manipulation, and a significant reputation loss for the institution. To patch this vulnerability, update the Student Learning Assessment and Support System to the latest version, ensuring that all sensitive pages enforce strict authentication checks. Additionally, review access controls and implement monitoring for unauthorized access attempts. You've got this! With these steps, you can secure the system and protect sensitive student information. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00385 · 31.4th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-12-15T11:15Z
References (2)
EPSS history
Timeline
  • 15 DEC 05:37Z
    JHENG GAO|Student Learning Assessment and Support System - Exposure of Sensitive Information
    cvelistv5