CVE-2025-10665

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Profilers/PProfile/COUNT3s3.php. The manipulation of the argument csem leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
kidaze	CourseSelectionSystem	42cd892b40a18d50bd4ed1905fa89f939173a464

References

https://github.com/qi-wm/cve/issues/1Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.324786Permissions Required, VDB Entry
https://vuldb.com/?id.324786Third Party Advisory, VDB Entry
https://vuldb.com/?submit.651941Third Party Advisory, VDB Entry

Timeline

Published: Sep 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-106669.8A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file appl CVE-2025-106679.8A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file CVE-2025-106689.8A security vulnerability has been detected in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file /members/co CVE-2025-106696.3A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Han CVE-2025-10677.3There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privilege CVE-2025-106709.8A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing o CVE-2025-106713.7A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-m CVE-2025-106727.8A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/Bat CVE-2025-106739.8A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the CVE-2025-106744.3A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attribut CVE-2025-106754.3A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/q CVE-2025-106764.3A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Execu