SourceCodester Student Grades Management System CVE-2025-12332

Upgrade to a patched version if available from the vendor; however, no specific patched version has been identified in the provided references, suggesting this may be open-source software where users are responsible for applying code fixes. As an immediate workaround, restrict administrative access to the /admin.php file using web server access controls (e.g., IP whitelisting, authentication requirements beyond the application layer) to limit who can reach the vulnerable delete_user function. If the application supports it, disable the delete_user feature entirely or implement strict input validation and output encoding for all user-supplied data, particularly in administrative functions. Additionally, apply Web Application Firewall (WAF) rules to detect and block common XSS payloads in request parameters passed to /admin.php. Refer to https://www.sourcecodester.com/ for official patches or security advisories. Given the low CVSS and EPSS scores, standard change management processes are appropriate; this does not require emergency patching.