EUVD-2025-18068Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical improper authentication vulnerability in code-projects School Fees Payment System version 1.0 that allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to the system. The vulnerability has been publicly disclosed with proof-of-concept exploitation details available, making it an active threat with high likelihood of real-world exploitation against educational institutions and payment processing systems.
Technical ContextAI
This vulnerability stems from a CWE-287 (Improper Authentication) flaw in the School Fees Payment System, indicating a fundamental weakness in how the application validates user credentials or session tokens. The root cause likely involves inadequate or missing authentication checks in one or more API endpoints or functional modules responsible for user access control. Given the context of a school fees payment system, the vulnerability probably affects authentication mechanisms protecting sensitive functions such as payment processing, student record access, or administrative dashboards. The 'unknown functionality' designation suggests the exact vulnerable code path has not been fully disclosed, but the authentication bypass enables complete circumvention of access controls.
Share
External POC / Exploit Code
Leaving vuln.today