CVE-2025-10479

CriticalCVSS 9.8/10Last modified Sep 30, 2026

Description

A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument stud_no results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-10488.8Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to ex CVE-2025-104809.8A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /sa CVE-2025-104818.8A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of CVE-2025-104829.8A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin CVE-2025-104838.8A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionalit CVE-2025-104849.8The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all version CVE-2025-104854.3A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_l CVE-2025-104865.3The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through CVE-2025-104877.3The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.CVE-2025-104888.1The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move CVE-2025-104894.3The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to u CVE-2025-10498.8Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut