CVE-2025-14588

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A security flaw has been discovered in itsourcecode Student Management System 1.0. This vulnerability affects unknown code of the file /update_program.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Student Management System	1.0

References

https://github.com/ltranquility/CVE/issues/24Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.336208Permissions Required, VDB Entry
https://vuldb.com/?id.336208Third Party Advisory, VDB Entry
https://vuldb.com/?submit.707081Third Party Advisory, VDB Entry

Timeline

Published: Dec 13, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-145898.8A weakness has been identified in code-projects Prison Management System 2.0. This issue affects some unknown processing of the file /admin/CVE-2025-14595.4The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all ve CVE-2025-145909.8A security vulnerability has been detected in code-projects Prison Management System 2.0. Impacted is an unknown function of the file /admin CVE-2025-145917.5In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-R CVE-2025-145925.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 th CVE-2025-145937.8A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A maliciou CVE-2025-145943.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 t CVE-2025-145954.3GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 tha CVE-2025-145966.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This CVE-2025-145989.8BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability e CVE-2025-145996.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite I CVE-2025-146009.3An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating app