CVE-2025-13274

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_fees. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2025
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-132754.7A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects anCVE-2025-132767.3A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects uCVE-2025-132779.8A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphotoCVE-2025-132788.8A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borroweCVE-2025-132798.8A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profileCVE-2025-13285.4The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter iCVE-2025-132809.8A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php CVE-2025-132815.8A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClassCVE-2025-132828.1TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web serverCVE-2025-132837.1TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local wCVE-2025-132849.8ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS cCVE-2025-132859.8A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php.