Is there a public PoC exploit available for CVE-2025-11329?

Yes, a public proof-of-concept exploit is available for CVE-2025-11329. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2025-11329

Q: What is the CVSS score of CVE-2025-11329?

CVE-2025-11329 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-06 cna@vuldb.com

PHP SQLi Online Course Registration Site Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:04 vuln.today

CVE Published

Oct 06, 2025 - 09:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in code-projects Online Course Registration 1.0. Impacted is an unknown function of the file /admin/manage-students.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

We need to produce a JSON analysis. The input provides CVE details, description, CVSS score (5.5) but that appears to be a CVSS v4.0 vector with base score likely computed from it? The given vector shows AV:N/AC:L/AT:N/PR:N/UI:N... so base score might be 5.5 but let's compute: CVSS 4.0 base metrics: AV:N/AC:L/AT:N/PR:N/UI:N impact to vulnerable system: VC:L/VI:L/VA:L (low on all), subsequent system: SC:N/SI:N/SA:N. The base score formula for CVSS 4.0: from spec, with SC:N/SI:N/SA:N, it's impact to VC,VI,VA only. The base score = max(impact score, exploitability score). Impact sub-score (ISS) = 1 - [(1-VC)*(1-VI)*(1-VA)] = 1 - (0.78*0.78*0.78)=1-0.474552=0.525448? wait VC=L=0.22? Actually CVSS 4.0 uses the same values as CVSS 3.1 for impact subscore? The CVSS 4.0 base score calculation: Exploitability (ESS) = something. But the base score as given is 5.5, which can be derived from that vector. So I'll accept that as the assessed score by NVD? The vector provided is a CVSS 4.0 vector, not 3.1. We need to produce our own assessed CVSS 3.1 and 4.0 vectors. I'll assess independently.

Description: SQL injection in code-projects Online Course Registration 1.0, file /admin/manage-students.php, parameter ID. Remote. Public exploit exists. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but SQL injection is CWE-89 typically. CWE-74 is generic, but could be mapping.

EPSS 0.03%, low. POC available. Not in KEV. Unknown patch status from input.

We need to produce all fields.

Product name: "Online Course Registration Site" (from CPE product) or "Online Course Registration"? The description says "code-projects Online Course Registration 1.0". CPE: fabian:online_course_registration_site:1.0. The vendor is "code-projects"? Actually "code-projects" is the website domain. The CPE product is "online_course_registration_site". So product name: "Online Course Registration Site 1.0" (maybe just "Online Course Registration Sit