CVE-2025-14256

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Student Management System	1.0

References

https://github.com/J0kkeR/cve/issues/1Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.334762Permissions Required, VDB Entry
https://vuldb.com/?id.334762Third Party Advisory, VDB Entry
https://vuldb.com/?submit.702484Third Party Advisory, VDB Entry
https://github.com/J0kkeR/cve/issues/1Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 8, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-142579.8A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing m CVE-2025-142589.8A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-142596.3A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0. Affected by this issue is some unknown functionality of the file /in CVE-2025-14268.8Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corrup CVE-2025-142608.3Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on af CVE-2025-142617.1The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its CVE-2025-142624.3A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there w CVE-2025-142659.1In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the inst CVE-2025-142660.6CSRF in Ercom Cryptobox administration console allows attacker to trigger some actions on behalf of a Cryptobox administrator. The attack re CVE-2025-142674.9Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure af CVE-2025-14277.8A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious CVE-2025-142702.7The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due t