CVE-2025-13273

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_payment. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	School Fees Payment Management System	1.0

References

https://github.com/ASantsSec/CVE/issues/20Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.332608Permissions Required, VDB Entry
https://vuldb.com/?id.332608Third Party Advisory, VDB Entry
https://vuldb.com/?submit.690048Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: Nov 17, 2025
Last modified: Oct 7, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-132748.8A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality CVE-2025-132754.7A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an CVE-2025-132767.3A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects u CVE-2025-132779.8A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto CVE-2025-132788.8A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowe CVE-2025-132798.8A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profile CVE-2025-13285.4The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter i CVE-2025-132809.8A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php CVE-2025-132815.8A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-132828.1TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server CVE-2025-132837.1TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local w CVE-2025-132849.8ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS c