CVE-2025-14335

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation of the argument sy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Student Management System	1.0

References

https://github.com/ltranquility/CVE/issues/20Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.335160Permissions Required, VDB Entry
https://vuldb.com/?id.335160Third Party Advisory, VDB Entry
https://vuldb.com/?submit.702743Third Party Advisory, VDB Entry

Timeline

Published: Dec 9, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-143369.8A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /p CVE-2025-143379.8A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This CVE-2025-143388.5Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to t CVE-2025-143396.5The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerabl CVE-2025-14346.1The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affe CVE-2025-143407.3Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead CVE-2025-143418.3Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnera CVE-2025-143424.3The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on CVE-2025-143437.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology Ltd. E-Com CVE-2025-143449.8The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation CVE-2025-143455.4A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical CVE-2025-143469.8WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within ran