CVE-2025-47573CWE-89

WordPress School Management System Plugin <= 92.0.0 - SQL Injection vulnerability

Critical · published June 17, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

🚨 A Blind SQL Injection vulnerability in mojoomla School Management could let attackers access sensitive data with just a sneaky input! 🔥 This is like a student sneaking into a school office with an open door and reading everyone’s confidential grades—no one notices until it’s too late! An attacker could exploit this flaw to read, modify, or even delete critical information without anyone realizing it. Think of all the sensitive student data that could be at risk. The consequences could be absolutely devastating!

Put simply

This is like a student sneaking into a school office with an open door and reading everyone’s confidential grades—no one notices until it’s too late! This SQL Injection vulnerability occurs due to improper handling of special elements in SQL commands, allowing attackers to manipulate queries and gain unauthorized access to the database. It affects mojoomla School Management versions up to 92.0.0.

What to do

An attacker could exploit this flaw to read, modify, or even delete critical information without anyone realizing it. Think of all the sensitive student data that could be at risk. The consequences could be absolutely devastating! Update mojoomla School Management to the latest version immediately to patch this vulnerability. Additionally, implement proper input validation and parameterized queries to strengthen your defenses against SQL Injection attacks. Don't wait! You've got this! Follow these steps and you'll lock down your application in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-06-17T15:01Z
EPSS history
Timeline
  • 17 JUN 15:01Z
    WordPress School Management System Plugin <= 92.0.0 - SQL Injection vulnerability
    cvelistv5