deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0687
Published: 2025-05-15
Description: The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c1e21e1-32f2-4a20-9262-80e1cdab534d/; https://wpscan.com/vulnerability/3c1e21e1-32f2-4a20-9262-80e1cdab534d/
CVE: CVE-2025-0688
Published: 2025-05-15
Description: The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1e2b77c3-ad45-4734-998a-c1722ebd1f4f/; https://wpscan.com/vulnerability/1e2b77c3-ad45-4734-998a-c1722ebd1f4f/
CVE: CVE-2025-1033
Published: 2025-05-15
Description: The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cbb63e80-92aa-4e85-9d47-dc68211af97d/; https://wpscan.com/vulnerability/cbb63e80-92aa-4e85-9d47-dc68211af97d/
CVE: CVE-2025-1286
Published: 2025-05-15
Description: The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c42556c7-09b6-49ae-9f87-cbaf16e7c280/; https://wpscan.com/vulnerability/c42556c7-09b6-49ae-9f87-cbaf16e7c280/
CVE: CVE-2025-1288
Published: 2025-05-15
Description: The WOOEXIM  WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/175af35d-6972-42c9-b7ac-913ce1fbac64/; https://wpscan.com/vulnerability/175af35d-6972-42c9-b7ac-913ce1fbac64/
CVE: CVE-2025-1289
Published: 2025-05-15
Description: The Plugin Oficial  WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5a296b59-f305-49a2-88b8-fca998f2c43e/; https://wpscan.com/vulnerability/5a296b59-f305-49a2-88b8-fca998f2c43e/
CVE: CVE-2025-1303
Published: 2025-05-15
Description: The Plugin Oficial  WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/35181798-4f21-4c8d-bb6e-61eb13683a74/; https://wpscan.com/vulnerability/35181798-4f21-4c8d-bb6e-61eb13683a74/
CVE: CVE-2025-1454
Published: 2025-05-15
Description: The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0089f813-82fa-4ffc-acd6-a70e67edc8ea/
CVE: CVE-2025-2203
Published: 2025-05-15
Description: The FunnelKit  WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/d553cff4-074a-44e7-aebe-e61c86ab8042/
CVE: CVE-2025-2247
Published: 2025-05-15
Description: The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/3974c5c3-887e-46bd-aad7-4f3169bff6de/
CVE: CVE-2025-2248
Published: 2025-05-15
Description: The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/b470a277-f5ad-49ff-97dd-4d3ee0269e5a/
CVE: CVE-2025-46834
Published: 2025-05-15
Description: Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys (scoped external keys) to external parties and would use the allowlist module to restrict which external contracts can be accessed by the session key. There is a bug in the allowlist module in that we don't check for the `executeUserOp` -> `execute` or `executeBatch` path, effectively allowing any session key to bypass any access control restrictions set on the session key. Session keys are able to access ERC20 and ERC721 token contracts amongst others, transferring all tokens from the account out andonfigure the permissions on external modules on session keys. They would be able to remove all restrictions set on themselves this way, or rotate the keys of other keys with higher privileges into keys that they control. Commit 5e6f540d249afcaeaf76ab95517d0359fde883b0 fixes this issue.
CWE: CWE-863
References: https://github.com/alchemyplatform/modular-account/commit/5e6f540d249afcaeaf76ab95517d0359fde883b0; https://github.com/alchemyplatform/modular-account/security/advisories/GHSA-jhp7-7cq9-m4pv
CVE: CVE-2025-47161
Published: 2025-05-15
Description: Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47161
CVE: CVE-2025-47784
Published: 2025-05-15
Description: Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit[PII_REDACTED]188b791419e3c[PII_REDACTED]256a8a2 fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/emlog/emlog/commit/[PII_REDACTED]188b791419e3c[PII_REDACTED]256a8a2; https://github.com/emlog/emlog/security/advisories/GHSA-f56g-m99v-mqc3
CVE: CVE-2025-47785
Published: 2025-05-15
Description: Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this will cause SQL injection to occur when the registered site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend remote code execution. As of time of publication, it is unknown whether a fix exists.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://github.com/emlog/emlog/security/advisories/GHSA-939m-47f7-m559; https://github.com/emlog/emlog/security/advisories/GHSA-939m-47f7-m559
CVE: CVE-2025-47786
Published: 2025-05-15
Description: Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In `/admin/comment.php`, the parameter `perpage_num` is not validated and is directly stored in the `admin_commend_perpage_num` field of the `emlog_options` table in the database. Moreover, the output is not filtered, resulting in the direct output of malicious code. As of time of publication, it is unclear if a patch exists.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/emlog/emlog/security/advisories/GHSA-82qc-9vg7-2c6c; https://github.com/emlog/emlog/security/advisories/GHSA-82qc-9vg7-2c6c
CVE: CVE-2025-47787
Published: 2025-05-15
Description: Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/emlog/emlog/commit/691c13e90df2fb35e120f4e0735078bad018eed7; https://github.com/emlog/emlog/security/advisories/GHSA-4mcj-8gvh-p753; https://github.com/emlog/emlog/security/advisories/GHSA-4mcj-8gvh-p753
CVE: CVE-2025-47788
Published: 2025-05-15
Description: Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was not properly validated, which could allow an attacker to execute arbitrary files on the server via path traversal. v602 contains a fix for the issue.
CWE: CWE-22, CWE-23
References: https://github.com/Atheos/Atheos/commit/97fe76871578d2011ebe9281f3a005c5df85162b; https://github.com/Atheos/Atheos/security/advisories/GHSA-x9vw-6vfx-7rx5; https://github.com/Atheos/Atheos/security/advisories/GHSA-x9vw-6vfx-7rx5
CVE: CVE-2025-47789
Published: 2025-05-15
Description: Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any arbitrary site, including phishing or malicious domains, which can be used to impersonate Horilla and trick users. Commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/horilla-opensource/horilla/commit/1c72404df6888bb23af73c767fdaee5e6679ebd6; https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468
CVE: CVE-2025-47928
Published: 2025-05-15
Description: Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`,  `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-488
References: https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d; https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f; https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8
CVE: CVE-2025-4715
Published: 2025-05-15
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /pages/view_application.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/9; https://vuldb.com/?ctiid.309013; https://vuldb.com/?id.309013
CVE: CVE-2025-4716
Published: 2025-05-15
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pages/credit_transaction_add.php. The manipulation of the argument prod_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/10; https://vuldb.com/?ctiid.309014; https://vuldb.com/?id.309014
CVE: CVE-2025-4717
Published: 2025-05-15
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Company Visitor Management System 2.0. Affected is an unknown function of the file /visitors-form.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/baixiaobai001/myCVE/issues/7; https://phpgurukul.com/; https://vuldb.com/?ctiid.309018
CVE: CVE-2025-1138
Published: 2025-05-15
Description: IBM InfoSphere Information Server 11.7 could disclose sensitive information to an authenticated user that could aid in further attacks against the system through a directory listing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-548
References: https://www.ibm.com/support/pages/node/7230295
CVE: CVE-2025-47929
Published: 2025-05-15
Description: DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the vulnerability.
CWE: CWE-79
References: https://github.com/DumbWareio/DumbDrop/commit/db27b25372eb9071e63583d8faed2111a2b79f1b; https://github.com/DumbWareio/DumbDrop/security/advisories/GHSA-gj32-5mgw-2w27
CVE: CVE-2025-4718
Published: 2025-05-15
Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/customer_add.php. The manipulation of the argument last leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/usingns/CVE/issues/1; https://vuldb.com/?ctiid.309019; https://vuldb.com/?id.309019
CVE: CVE-2025-4719
Published: 2025-05-15
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/cash_transaction.php. The manipulation of the argument cid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/usingns/CVE/issues/2; https://vuldb.com/?ctiid.309020; https://vuldb.com/?id.309020
CVE: CVE-2025-4720
Published: 2025-05-15
Description: A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file academic/core/drop_student.php. The manipulation of the argument img leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/Xiaoyi-ing/CVE/issues/4; https://vuldb.com/?ctiid.309022; https://vuldb.com/?id.309022
CVE: CVE-2025-4721
Published: 2025-05-15
Description: A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /drive.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/byxs0x0/cve/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.309023
CVE: CVE-2025-47275
Published: 2025-05-15
Description: Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389; https://github.com/auth0/auth0-PHP/releases/tag/8.14.0; https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
CVE: CVE-2025-47287
Published: 2025-05-15
Description: Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3; https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m; https://lists.debian.org/debian-lts-announce/2025/05/msg00038.html
CVE: CVE-2025-4722
Published: 2025-05-15
Description: A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file /edit_profile.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/byxs0x0/cve/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.309024
CVE: CVE-2025-4723
Published: 2025-05-15
Description: A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /all_student.php. The manipulation of the argument delete leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/byxs0x0/cve/issues/5; https://itsourcecode.com/; https://vuldb.com/?ctiid.309025
CVE: CVE-2025-4724
Published: 2025-05-15
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Placement Management System 1.0. Affected by this issue is some unknown functionality of the file /student_profile.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Lena-lyy/SQL/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.309026
CVE: CVE-2025-4725
Published: 2025-05-15
Description: A vulnerability, which was classified as critical, was found in itsourcecode Placement Management System 1.0. This affects an unknown part of the file /view_drive.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Lena-lyy/SQL/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.309027
CVE: CVE-2025-0921
Published: 2025-05-15
Description: Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric BizViz all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS versions 11.00, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95, Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions, Mitsubishi Electric Iconics Digital Solutions BizViz all versions,  and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-250
References: https://jvn.jp/vu/JVNVU93838985; https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf
CVE: CVE-2025-4209
Published: 2025-05-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-4726
Published: 2025-05-15
Description: A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /view_student.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Lena-lyy/SQL/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.309028