Student File Management System
CVE-2025-14646
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /admin/delete_student.php
-
ExploitInject SQL payload via stud_id parameter
-
ExecutionDatabase executes unauthorized query
-
ImpactDelete or extract student data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of Student File Management System 1.0. |
| Impact | CVSS 4.0 rates this vulnerability as 5.5 (Medium), with a network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. EPSS predicts a 0.07% probability of exploitation, indicating low likelihood of widespread attacks. No CISA KEV listing suggests it is not currently targeted in active campaigns. Despite the public exploit code, the combination of low EPSS and limited CVSS impact reduces the real-world urgency; it is not a critical priority. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to /admin/delete_student.php containing a malicious SQL payload in the stud_id parameter. The injected command can delete student records or extract sensitive data from the database. Public exploit code is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
RemediationAI
No vendor-released patch is available. As a temporary mitigation, restrict access to the /admin/ directory to trusted IP addresses via web server access controls. Alternatively, disable or remove the delete_student.php script if not essential, though this will break the corresponding deletion functionality. Implement parameterized queries or input validation within the application code as a long-term fix, but be aware that ad-hoc code changes may introduce new issues.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP-based web application (Student File Management System 1.0) that fails to properly sanitize user input before incorporating it into an SQL query. The affected file /admin/delete_student.php receives the stud_id parameter directly from HTTP requests and embeds it in a database statement, enabling SQL injection. The root cause classifies under CWE-74 (Improper Neutralization of Special Elements), a parent category of injection flaws. The precise affected software is identified by CPE cpe:2.3:a:fabian:student_file_management_system:1.0.
Know when Student File Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated attack with low complexity; SQL injection typically allows limited data exposure or manipulation.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in code-projects Student File Management System 1.0. This impacts an unknown function of the file /admin/delete_student.php. The manipulation of the argument stud_id results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to ma
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queri
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Usern
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queri
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remot
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated re
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject mal
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticat
Exploit-DB